RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c

because the only way apache would allow php to work was via an Action redirect, and that had to be accessible in the docroot, it was possible to go to www.example.com/php/php.exe?c:\winnt\repair\sam (for example) and see sensitive data. now we just deny all direct requests to the cli in that scenario. -- james > -----Original Message----- > From: Preston L. Bannister [mailto:preston.bannister@cox.net] > Sent: Friday, May 10, 2002 12:39 AM > To: James Cox; Shane Caraveo > Cc: php-cvs@lists.php.net > Subject: RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c > > > Reverted the change. Would like to find a better way to do this. > > How did you generate an exploit? > > > > -----Original Message----- > > From: James Cox [mailto:james@blog.at] > > Sent: Thursday, May 09, 2002 4:20 PM > > To: Preston L. Bannister; Shane Caraveo > > Cc: php-cvs@lists.php.net > > Subject: RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c > > > > > > Preston, > > > > Basically, when Shane and I were testing, we discovered that it was > > impossible to really find any one single variable/flag that > could be used to > > tell us the status of the CGI REDIRECT ENV, and so we could not > be sure what > > way the CGI was being called -- directly, like Apache, or > redirected like > > IIS. And we know that calling it directly causes bad things to happen. > > > > So, we have patched it so that any direct calls fail, unless the > > CGI-REDIRECT-ENV is set automatically -- ie, in php.ini. > > > > Yes -- we could add a bunch of ifs for different known vars, > eg, for IIS, or > > for Apache signatures, but that doesn't make for nice code, and requires > > updating, and is messy. > > > > Find something common to all of them, and add that to php.ini as the > > cgi.redirect-env var. > > > > Apart from that, this code shouldn't be changed. it's safe, and > doesn't need > > to be compromised by individual cases. please revert! > > > > James > > > > > > > > OK - installed PWS on my Win98 box - the one invisible to the > Internet :). > > > > > > Just so I'm entirely clear - what am I looking for? I was looking for > > > some sort of on-line discussion of the issue, but I guess I'm > not looking > > > in the right place. > > > > > > > > > From: Shane Caraveo [mailto:shane@caraveo.com] > > > > > > > > Preston L. Bannister wrote: > > > > > From: Shane Caraveo [mailto:shane@caraveo.com] > > > > > > > > > >>Not cool. I'm sure other servers also don't require > > > force_redirect, so > > > > >>do we start building a large if block checking for any server that > > > > >>doesn't? Simply setting cgi.force_redirect=0 in php.ini fixes the > > > > >>problem. If something more is needed, make it generic, > not specific. > > > > > > > > > > > > > > > OK - if the goal is to make default configuration do the > right thing > > > > > (so the guy installing PHP has less to get wrong) what would > > > be generic? > > > > > > > > > > Pragmatically there are two web servers used by the > majority of sites > > > > > (Apache and IIS) so building knowledge into the code > rather than into > > > > > the documentation for the most common cases makes everyone's > > > life simpler. > > > > > > > > > > I don't mind putting this into a different form. What would > > > you suggest? > > > > > > > > Something other than checking that an environment variable has > > > a secific > > > > value. For Apache we don't check what the value of the > vars are, but > > > > that the vars exist. The advantage of this is that if the > > > value changes > > > > for some reason, php doesn't have to change to work with > it. So find a > > > > common var that is available on the majority of MS os/web server > > > > combinations, and NOT common on other web servers (I beleive > > > there are a > > > > couple), then make the default of cgi.redirect_status_env in php.ini > > > > that var name. Requires no code change. > > > > > > > > > -- > > > PHP CVS Mailing List (http://www.php.net/) > > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > > > > > > > >