Apache web server bug grants root access on shared hosting environments

Re:Apache web server bug grants root access on shared hostin... by 3ch0 on Thursday April 04, 2019 @09:19AM (#19571925)

Found this, looks like a more detailed writeup of whats going on. https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-loc...

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by ajackfox on Thursday April 04, 2019 @09:43AM (#19572173)

Probably a stupid question, but are the version #'s mentioned here ( "From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading to an arbitrary function call." ) the only ones affected, or is it possible earlier versions are affected as well?

Also, I just want to throw out there that the name of this one is great:

"Why the name ? CARPE: stands for CVE-2019-0211 Apache Root Privilege Escalation DIEM: the exploit triggers once a day

I had to."

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by dspillett on Thursday April 04, 2019 @12:41PM (#19574330)

> but are the version #'s mentioned here ... the only ones affected

Usually when a range like that is given, yes.

> From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019)

This case implies that they know the bug was introduced in a particular change, which went public with version 2.4.17 and was either fixed or otherwise mitigated in 2.4.38.

The only earlier or other versions that I would expect to see affected are dev/alpha/beta branches.

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by ec109685 on Thursday April 04, 2019 @10:59AM (#19573079)

This part is concerning:

> Apache's team has been prompt to respond and patch, and nice as hell. Really good experience. PHP never answered regarding the UAF.

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by hannob on Thursday April 04, 2019 @12:24PM (#19574152)

FWIW I reported it to PHPs bugtracker: https://bugs.php.net/bug.php?id=77843

I expect that it'll be fixed, not not handled as a security issue, as it doesn't fit within PHPs model of security vulns.

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by jimktrains2 on Thursday April 04, 2019 @12:31PM (#19574232)

> This looks like it requires specially crafted code, therefore not a security issue.

I'm not sure how I feel about such a response. Many exploits require odd, but valid code, and more often than not it exists out there.

Also, it feels weird for this to be tagged as a JSON issue?

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by jsight on Thursday April 04, 2019 @03:29PM (#19576204)

Basically they don't consider the engineer exploiting the interpreter to be a security vulnerability. That seems a bit dubious, but I can see where they are coming from in treating the script author as a trusted party.

[ Parent | on HN ]

Re:Apache web server bug grants root access on shared hostin... by Operyl on Thursday April 04, 2019 @11:57AM (#19573828)

That’s been my experience reporting any kind of bug with the PHP core team. It really is a pain in the neck.

[ Parent | on HN ]