205 Apache 2.x HTTPS mod_php hijacking HTTP 2003/12/30 Mo momolly at wireless-warrior dot org http://www.wireless-warrior.org Marc Ruef marc dot ruef at computec dot ch http://www.computec.ch computec.ch 2004/11/13 2.1 Did some major changes in version 2.0 because this plugin was first written for ATK 1.0 and not released until the release week of ATK 2.1. Corrected the plugin structure and added the accuracy values in 2.1 tcp 80 open|send HEAD / HTTP/1.0\n\n|sleep|close|pattern_exists HTTP/1.[0-1] ### *Server: Apache/4.[2-3]* OR HTTP/1.[0-1] ### *Server: Apache/2.0.* 80 The trigger works not perfectly. But the last few vulnerable Apache versions could be identified. Steve Grubb linux_4ever at yahoo dot com 2003/12/26 http://www.securityfocus.com/archive/1/348368 Apache Software Foundation apache at apache dot org http://httpd.apache.org Mod_php under Apache 2.0.x Configuration When using mod_php, many file descriptors are leaked to the php script process. If the script page calls external programs by passthru(), exec(), or system(), thedescriptors are leaked to that program as well. One of these descriptors is the listening descriptor to port 443, also known as https. Port 443 is a privileged port and can only be bound to by a root process. It is not normal for that descriptor to be leaked to any or all programs. As a side note, this descriptor seems to be opened by apache regardless of whether or not you use https. Upgrade your mod_php to the latest version. Approx. 20 minutes Maybe http://www.securityfocus.com/bid/9302/exploit/ Yes Yes High 8 5 8 7 9302 10507 http://www.securiteam.com/unixfocus/5JP091FBPI.html 460 Hacking Intern - Angriffe, Strategien, Abwehr, Marc Ruef, Marko Rogge, Uwe Velten and Wolfram Gieseke, November 1, 2002, Data Becker, Düsseldorf, ISBN 381582284X http://www.computec.ch