1 |
On 04/25/2015 05:23 PM, Grant wrote: |
2 |
> I read about this vulnerability in the |
3 |
> 2015-04-06-apache-addhandler-addtype Gentoo news item. I don't think |
4 |
> I'm using any functionality that could expose me to the problem but |
5 |
> I'd like to be able to say so for sure. Does the fact that I'm |
6 |
> up-to-date with GLSAs, I don't have PHP5 in APACHE2_OPTS (I use |
7 |
> php-fpm), along with the following (which I think is default) indicate |
8 |
> that I'm not vulnerable? |
9 |
|
10 |
(1) Do you allow untrusted people to upload files to your server? |
11 |
|
12 |
(2) If so, do you try to prevent them from uploading PHP files |
13 |
based on a regular expression or shell glob? |
14 |
|
15 |
Unless you answer "yes" to both of those questions, you don't need to |
16 |
check anything. |
17 |
|
18 |
The vulnerability is that with, |
19 |
|
20 |
AddHandler application/x-httpd-php .php |
21 |
|
22 |
Apache will go ahead and try to execute (for example) foo.php.html. If |
23 |
you're blocking uploads of *.php to prevent people from uploading PHP |
24 |
scripts, then I could name my file foo.php.html and bypass your restriction. |
25 |
|
26 |
The AddHandler behavior was documented, but incredibly unexpected -- and |
27 |
we had it in the default configuration. The new config we ship uses, |
28 |
|
29 |
<FilesMatch "\.php$"> |
30 |
SetHandler application/x-httpd-php |
31 |
</FilesMatch> |
32 |
|
33 |
instead so only *.php files get executed. |