Vulnerability Development mailing list archives
Re: Another flaw in Apache?
From: Filipe Almeida <filipe () rnl ist utl pt>
Date: Sun, 23 Jun 2002 16:07:04 +0100
Well... Seems I rushed the mail out. You can kill the httpd childs but you can't ptrace them because the processes are not dumpable. At 10:13 23-06-2002 -0400, Michal Zalewski wrote:
On Sun, 23 Jun 2002, Filipe Jorge Marques de Almeida wrote: Not exactly. You are having access to the httpd child process, not a spawned CGI script. This means that you control some interesting goods, such as file descriptors, or... oh well, the child process itself. Think about serving spoofed contents to all requests? Besides, suexec is pretty popular nowadays.
Current thread:
- Another flaw in Apache? Jedi/Sector One (Jun 22)
- Re: Another flaw in Apache? Jedi/Sector One (Jun 22)
- Re: Another flaw in Apache? Michal Zalewski (Jun 22)
- Re: Another flaw in Apache? Jedi/Sector One (Jun 22)
- Re: Another flaw in Apache? Alexander Yurchenko (Jun 22)
- RE: Another flaw in Apache? Ryan Sweat (Jun 22)
- Re: Another flaw in Apache? Michal Zalewski (Jun 22)
- Re: Another flaw in Apache? Jedi/Sector One (Jun 23)
- Re: Another flaw in Apache? Filipe Jorge Marques de Almeida (Jun 23)
- Re: Another flaw in Apache? Jedi/Sector One (Jun 23)
- Message not available
- Re: Another flaw in Apache? Filipe Almeida (Jun 23)
- Re: Another flaw in Apache? Alexander Yurchenko (Jun 23)
- Re: Another flaw in Apache? Jedi/Sector One (Jun 23)
- Re: Another flaw in Apache? Michal Zalewski (Jun 23)
- Re: Another flaw in Apache? Michal Zalewski (Jun 23)
- Re: Another flaw in Apache? sd (Jun 26)