Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:84686
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain bof.de designates 80.242.145.70 as permitted sender)
To: internals@lists.php.net
Date: Fri, 13 Mar 2015 16:01:51 +0100
Message-ID: <4426444.JgVMhxXZoq@rofl>
User-Agent: KMail/4.14.4 (Linux/3.19.1-2.gc0946e9-desktop; KDE/4.14.4; x86_64; ; )
In-Reply-To: <3961990.KljssxxPxS@rofl>
References: <3961990.KljssxxPxS@rofl>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Subject: Re: [PHP-DEV] SAPI apache2handler + pipelined HTTP request core dumps
From: php@bof.de (Patrick Schaaf)

On Tuesday 10 March 2015 10:26:12 Patrick Schaaf wrote:
> 
> https://bugs.php.net/bug.php?id=68486

Meanwhile I did some more debugging, today also testing with a freshly 
compiled current apache 2.4.12. The issue persists.

As it does not always coredump, but always uncontrollably reenters an already-
deconfigured PHP interpreter, I see the potential for arbitrary remote code 
execution. I opened a security bug for that two days ago - no reaction.

Sorry for shouting, BUT IS REALLY NOBODY HERE INTERESTED IN (non-fpm) PHP 
UNDER APACHE 2.4 / LINUX ??????

I don't want to go out on the internet and test whether I can randomly crash 
any such server, but everything I analyzed so far tells me that half of the 
world might be affected by this.

For those who cannot be bothered to read the bug report, but have an apache 
2.4 running with mod_php, could you please run the following against your 
server, and look for segmentation violation / coredump messages in your server 
logs?

echo -e 'GET /foo.php HTTP/1.1\nHost: www.example.de\n\nGET /foo.php 
HTTP/1.1\nHost: www.example.de\n\n' | nc localhost 80

(of course, replace /foo.php with any trivial PHP script on your server, and 
www.example.de with your virtual host name)

best regards
  Patrick

P.S.: to anybody who now wants to tell me to just use FPM/fastCGI: save the 
bits, I don't want to hear that.