Release Date: 2003-12-29
Critical:
Less critical
Impact: Hijacking
Privilege escalation
Where: Local system
Software: PHP 4.2.x, PHP 4.3.x
Description:
Steve Grubb has reported a vulnerability in PHP, which potentially can be exploited by malicious, local users to hi-jack the HTTPS port.
The problem is that PHP / mod_php in combination with Apache 2 leaks the HTTPS listening file descriptor to child processes. Users, who can manipulate the file descriptor, may be able to listen on port 443/tcp.
This vulnerability is a variant of an older vulnerability in Apache 2:
SA8499
Solution:
Restrict access to ensure that only trusted users can execute code such as PHP.
Provided and/or discovered by:
Steve Grubb
Other References:
SA8499:
http://www.secunia.com/advisories/8499/
Source: Secunia