PHP May Apply Incorrect php_admin_* Settings To Requests for Apache Virtual Hosts
|
|
SecurityTracker Alert ID: 1008973
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Feb 7 2004
|
Impact: Disclosure of system information, Disclosure of user information, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 4.3.4 and prior versions
|
Description: A vulnerability was reported in PHP when used on Apache in a virtual host configuration. Some 'php.ini' settings applicable to one virtual host may be incorrectly applied to a different virtual host in certain cases.
It is reported that if the target server's 'php.ini' file contains the 'register_globals = on' setting and an HTTP request is made
to one virtual host and the subsequent HTTP request is made to the same Apache child process but to a different virtual host, some
php_admin_* settings from the former virtual host may incorrectly persist and be applied to the latter virtual host.
The bug
reportedly resides in 'sapi/apache/mod_php4.c'.
|
Impact: The specific impact depends on the configuration. A remote user may be able to gain access to restricted directories or files.
|
Solution: A fix is available via CVS. The patch was added to 'sapi/apache/mod_php4.c' on 2004-01-28.
|
Vendor URL: bugs.php.net/bug.php?id=25753 (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Sat, 07 Feb 2004 01:13:30 -0500
Subject: http://bugs.php.net/bug.php?id=25753
|
http://bugs.php.net/bug.php?id=25753
> Bug #25753 php_value|flag / php_admin_* settings "leak" from vhosts/.htaccess files
sniper wrote:
> If (for example) one virtualhost configuration has
> set "php_admin_flag register_globals off", in some situations the
> setting persists between requests.
> -> php.ini settings are NOT reset between requests.
>
> 1. php.ini has register_globals = On
> 2. Request is made into www.foobar.com
> (which has "php_admin_flag register_globals off")
> 3. Next request (same apache child) is made into www.barfoo.com (which
> does not have the setting)
>
> This applies to ALL php.ini directives.
The bug reportedly resides in 'sapi/apache/mod_php4.c'.
A patch was added to CVS on 2004-01-28.
|
|
