Bugtraq mailing list archives
Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure
From: king cope <isowarez.isowarez.isowarez () googlemail com>
Date: Wed, 7 Aug 2013 23:08:26 +0700
hi... I posted the advisory to make administratos aware that it will be still possible to read files with the apache uid even when suEXEC is in place. suEXEC is installed on many hosting providers. I read the cpanel site describing the patches [1], tough standart apache httpd does not have these patches installed. SymLinksIfOwnerMatch will not help in this attack scenario because the .htaccess file overwrites this Options directive. If a hacker sees an apache installation using suEXEC from an attackers perspective it does not matter where the bug resides, either in Apache or in suEXEC. He just wants to circumvent the suEXEC protection so he can go the way described in the text I posted. This will aid him to escalate privileges further. http://docs.cpanel.net/twiki/bin/vief/EasyApache/Apache/SymlinkPatch#Frequently%20Asked%20Questions
Current thread:
- Apache suEXEC privilege elevation / information disclosure king cope (Aug 07)
- Message not available
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure king cope (Aug 07)
- Message not available
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Michal Zalewski (Aug 11)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Tobias Kreidl (Aug 11)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure king cope (Aug 07)
- Message not available
- Re: Apache suEXEC privilege elevation / information disclosure Kingcope (Aug 09)
- RE: [Full-disclosure] Apache suEXEC privilege elevation / Dico Emil (Aug 09)
- Message not available
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Gichuki John Chuksjonia (Aug 10)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Jeffrey Walton (Aug 10)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure Reindl Harald (Aug 10)
- Re: [Full-disclosure] Apache suEXEC privilege elevation / information disclosure terry white (Aug 11)