• Choose a category
• All
• Classic-Fiction

By Root 1861 0

itself and then make the exec( ) call from the child instance. The parent instance keeps on working. As you would expect, cloning creates two identical copies of the initial process. This means that both processes have the same environment, permissions, and open file descriptors. All these extra privileges must be cleaned up before the control is given to some untrusted binary running as another user. (You need to be aware of the issue of file descriptor leaks but you do not need to be concerned with the cleanup process itself.) If cleaning is not thorough enough, a rogue CGI script can take control over resources held by the parent process.

If this seems too vague, examine the following vulnerabilities:

"Apache Web Server File Descriptor Leakage Vulnerability" (http://www.securityfocus.com/bid/7255)

"Apache mod_php File Descriptor Leakage" (http://www.osvdb.org/displayvuln.php?osvdb_id=3215)

When a file descriptor is leaked, the child process can do anything it wants with it. If a descriptor points to a log file, for example, the child can write to it and fake log entries. If a descriptor is a listening socket, the child can hijack the server.

Information leaks of this kind can be detected using the helper tool env_audit (http://www.web-insights.net/env_audit/). The tool is distributed with extensive documentation, research, and recommendations for programmers. To test Apache and mod_cgi, drop the binary into the cgi-bin folder and invoke it as a CGI script using a browser. The output will show the process information, environment details, resource limits, and a list of open descriptors. The mod_cgi output shows only three file descriptors (one for stdin, stdout, and stderr), which is how it should be:

Open file descriptor: 0

User ID of File Owner: httpd

Group ID of File Owner: httpd

Descriptor is stdin.

No controlling terminal

File type: fifo, inode - 1825, device - 5

The descriptor is: pipe:[1825]

File descriptor mode is: read only

----

Open file descriptor: 1

User ID of File Owner: httpd

Group ID of File Owner: httpd

Descriptor is stdout.

No controlling terminal

File type: fifo, inode - 1826, device - 5

The descriptor is: pipe:[1826]

File descriptor mode is: write only

----

Open file descriptor: 2

User ID of File Owner: httpd

Group ID of File Owner: httpd

Descriptor is stderr.

No controlling terminal

File type: fifo, inode - 1827, device - 5

The descriptor is: pipe:[1827]

File descriptor mode is: write only

As a comparison, examine the output from executing a binary from mod_php. First, create a simple file (e.g., calling it env_test.php) containing the following to invoke the audit script (adjust the location of the binary if necessary):

system("/usr/local/apache/cgi-bin/env_audit");

echo("Done.");

?>

Since the audit script does not know it was invoked through the web server, the results will be stored in the file /tmp/env_audit0000.log. In my output, there were five descriptors in addition to the three expected (and shown in the mod_cgi output above). The following are fragments of the output I received. (Descriptor numbers may be different in your case.)

Here is the part of the output that shows an open descriptor 3, representing the socket listening on (privileged) port 80:

Open file descriptor: 3

User ID of File Owner: root

Group ID of File Owner: root

WARNING - Descriptor is leaked from parent.

File type: socket

Address Family: AF_INET

Local address: 0.0.0.0

Local Port: 80, http

NOTICE - connected to a privileged port

WARNING - Appears to be a listening descriptor - WAHOO!

Peer address: UNKNOWN

File descriptor mode is: read and write

In the further output, descriptors 4 and 5 were pipes used for communication with the CGI script, and descriptor 8 represented one open connection from the server to a client. But descriptors 6 and 7 are of particular interest because they represent the error log and the access log, respectively:

Open file descriptor: 6

User ID of File Owner: root

Group ID of File Owner: root

WARNING - Descriptor is leaked from