Re: [Security-Discuss] Possible PHP hole in Perl?

Hi Ronald,

> At least in Mdk 8.2 and up, if you installed Apache and Apache-mod_perl, the Apache-mod_perl would 
> answer on port 8200.  I've got an app that runs in perl, and it runs much faster under the apache 
> mod_perl server.  Good stuff.
> 
> Now here's the problem: let's say you have a php file that accesses a database.  Within the php 
> file, you put the username/password for the database.  Normally, a user would never see this code, 
> as it is executed by the php processor called from Apache.  Let's say your file is called test.php. 
>   So if you browse: http://yourserver/test.php, you'll see the rendered page.  However, if you 
> browse http://yourserver:8200/test.php, it triggers a download of the actual (unrendered) php file, 
> comments and all.  Normally, one would not try to access a php file via the apache mod_perl, but I 
> just tried doing it on a bunch of machines here, and it does the above on all of them.

I have had this problem myself on more than one MDK install including
10.0.  I overcame it by ensuring that I have the correct php modules
installed.  I don't know which of yours are missing but I have listed
what I have installed for you to compare.

libphp_common (This may be the missing culprit)
mod_php
php-cgi
php-gd
php-imap
php-ini
php-ldap
php-mysql
php-readline
php-xml
php-xmlrpc

Hope this helps,

Regards,

Rick

> 
> This could be a huge security leak.  I know at least for my scripts, it will reveal sql passwords, 
> and certain file paths.
> 
> For now, I've disabled the port 8200 on those sites.  But there must be some simple fix.
> 
> Bob
> 
> 
> Ronald Ip wrote:
> > On Mon, 2004-06-14 at 12:04, Bob Puff wrote:
> > 
> >>Hmm, I just tried this with a pretty stock 9.0, as well as a 9.2 install of
> >>Apache2 and Apache-perl, and the same thing - when browing a .php page on the
> >>Apache-perl port, I see the original php source.
> >>
> >>If this is a misconfig in the apache-perl config, what part tells it to
> >>include the php rendering engine?  It certainly appears to be not working by
> >>default.
> > 
> > 
> > The directives to be included into httpd.conf by php is usually found in
> > /etc/httpd/conf.d/*_mod_php.conf
> > 
> > I'm not exactly sure if apache-perl should be used to serve php pages
> > alone(?). When I used Apache1, both Apache1 and Apache1-perl, were made
> > work together by default. Allowing the Apache1 to handle regular pages
> > and Apache1-perl handle the dynamic stuff. http://www.advx.org/
> > 
> > Therefore, I am quite confused by "when browing a .php page on the
> > Apache-perl port, I see the original php source."
> > 
> > The Apache-perl port part. How did u access it? Via regular port 80?
> > 
> > Please correct me if I am wrong.
> > 
> > --Ronald
> > 
> > 
> >>Bob
> >>
> >>---------- Original Message -----------
> >>From: "Ronald Ip" <myself-zSWdYiJ/+5RWk0Htik3J/[email protected]>
> >>To: security-discuss-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
> >>Sent: Mon, 14 Jun 2004 00:41:51 +0800 (SGT)
> >>Subject: Re: [Security-Discuss] Possible PHP hole in Perl?
> >>
> >>
> >>>Hi,
> >>>
> >>>Bob [email protected] said:
> >>>
> >>>>Hello,
> >>>>
> >>>>Just saw this tonight on one of my boxes.  If I have mod_perl running as a
> >>>>webserver on port 8200
> >>>>(the default), and I browse to a .php page, the page is sent without being
> >>>>rendered by the php
> >>>>engine - exposing some potentially juicy stuff.  Is this a
> >>>>misconfiguration on my part, or a
> >>>>real hole?
> >>>
> >>>It's more like a mis-config. Check that you have the relevent directives
> >>>required by php in ur httpd.conf.
> >>>
> >>>
> >>>>Bob
> >>>>
> >>>>Example: http://localhost:8200/myfile.php
> >>>>
> >>>>
> >>>>
> >>>
> >>>-- 
> >>>Ronald Ip                              myself-zSWdYiJ/+5RWk0Htik3J/[email protected]
> >>>gpg public key @ http://iphoting.iphoting.com/iphoting.asc
> >>>Fingerprint: {6A7E AB1E A822 E621 4DEC 11C4 F355 0635 71D7 1151}
> >>
> >>------- End of Original Message -------
> >>
> >>
> >>
> >>______________________________________________________________________
> >>____________________________________________________
> >>Want to buy your Pack or Services from MandrakeSoft? 
> >>Go to http://www.mandrakestore.com
> >>Join the Club : http://www.mandrakeclub.com
> >>____________________________________________________
> > 
> > --
> > Ronald Ip                              myself-zSWdYiJ/+5RWk0Htik3J/[email protected]
> > gpg public key @ http://iphoting.iphoting.com/iphoting.asc
> > Fingerprint: {6A7E AB1E A822 E621 4DEC 11C4 F355 0635 71D7 1151}
> 
> 
> 
> ______________________________________________________________________
> ____________________________________________________
> Want to buy your Pack or Services from MandrakeSoft? 
> Go to http://www.mandrakestore.com
> Join the Club : http://www.mandrakeclub.com
> ____________________________________________________
-- 
Suncoast Technical
Ph 07 5442 5423
Fx 07 5442 5712
www.suntech.net.au

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________