You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Adam Goldstein <wh...@whitewlf.net> on 2004/02/04 18:27:00 UTC
[users@httpd] Strange Error log msgs
Has anyone ever seen this appear in an (Apache2.0.47) error_log?
su: invalid option -- a
Try `su --help' for more information.
Server configured with:
apache-conf-2.0.47-8mdk
apache2-mod_proxy-2.0.47-6.3.92mdk
apache2-mod_ssl-2.0.47-6.3.92mdk
apache2-2.0.47-6.3.92mdk
apache2-mod_cache-2.0.47-6.3.92mdk
apache2-common-2.0.47-6.3.92mdk
apache2-mod_dosevasive-2.0.47_1.8-1mdk
apache2-mod_mem_cache-2.0.47-6.3.92mdk
apache2-mod_php-2.0.47_4.3.2-2mdk
apache2-modules-2.0.47-6.3.92mdk
apache2-mod_disk_cache-2.0.47-6.3.92mdk
php-mysql-4.3.2-3mdk
php-xml-4.3.2-3mdk
php-ini-4.3.3-1mdk
php-gd-4.3.2-4mdk
php-ldap-4.3.2-3mdk
php-readline-4.3.2-3mdk
phpgroupware-0.9.14.006-2mdk
php-cli-4.3.3-2mdk
php-mmcache-4.3.3_2.4.2-1mdk
php-zip-4.3.3-2mdk
php-iconv-4.3.3-1mdk
libphp_common432-4.3.3-2mdk
php-imap-4.3.2-3mdk
php-recode-4.3.3-1mdk
php-snmp-4.3.4-2mdk
--
Adam Goldstein
White Wolf Networks
http://whitewlf.net
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Strange Error log msgs
Posted by Jez Hancock <je...@munk.nu>.
On Fri, Feb 06, 2004 at 12:19:27PM -0500, Adam Goldstein wrote:
> This is a dedicated user system, and the site author says nothing uses
> 'su' , and everything is in php, no cgi.
> neither apache nor php has suexec capability.
>
> I did a grep for "su -a" and found nothing, and obviously grep'ing for
> just "su" would be a bit crazy.
>
> the error has no time stamp, and no page reference.
> Is there any known exploit or vulnerability in that version of apache
> to allow an su command to occur from an outside request?
The error would occur if someone put this in a php script:
$bleh=`su -a`;
It's not a problem with apache in short - the problem is with a
script that is being misused - either maliciously or inadvertently.
Unfortunately grepping for 'su' might not even be enough - consider
some code like this in a php script:
$output=`$_POST["cmd"]`;
then if someone posted a form after entering 'su -a' in the 'cmd' form
field, the error you're seeing would be generated.
--
Jez Hancock
- System Administrator / PHP Developer
http://munk.nu/
http://jez.hancock-family.com/ - Another FreeBSD Diary
http://ipfwstats.sf.net/ - ipfw peruser traffic logging
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Strange Error log msgs
Posted by Adam Goldstein <wh...@whitewlf.net>.
This is a dedicated user system, and the site author says nothing uses
'su' , and everything is in php, no cgi.
neither apache nor php has suexec capability.
I did a grep for "su -a" and found nothing, and obviously grep'ing for
just "su" would be a bit crazy.
the error has no time stamp, and no page reference.
Is there any known exploit or vulnerability in that version of apache
to allow an su command to occur from an outside request?
--
Adam Goldstein
White Wolf Networks
http://whitewlf.net
On Feb 5, 2004, at 4:38 AM, Jez Hancock wrote:
> On Wed, Feb 04, 2004 at 12:27:00PM -0500, Adam Goldstein wrote:
>> Has anyone ever seen this appear in an (Apache2.0.47) error_log?
>>
>> su: invalid option -- a
>> Try `su --help' for more information.
> Someone may be trying to execute the 'su' command from an HTML form and
> the error is being logged to the error_log. I have a PHP script that
> displays man pages and if a user enters a page that doesn't exist the
> error is dumped to the error log file:
>
> No manual entry for <some non-existent manpage>
>
> There's an entry in my blog at http://jez.hancock-family.com/ about
> exploiting CGI scripts which might be of interest.
>
> --
> Jez Hancock
> - System Administrator / PHP Developer
>
> http://munk.nu/
> http://jez.hancock-family.com/ - Another FreeBSD Diary
> http://ipfwstats.sf.net/ - ipfw peruser traffic logging
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server
> Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Strange Error log msgs
Posted by Jez Hancock <je...@munk.nu>.
On Wed, Feb 04, 2004 at 12:27:00PM -0500, Adam Goldstein wrote:
> Has anyone ever seen this appear in an (Apache2.0.47) error_log?
>
> su: invalid option -- a
> Try `su --help' for more information.
Someone may be trying to execute the 'su' command from an HTML form and
the error is being logged to the error_log. I have a PHP script that
displays man pages and if a user enters a page that doesn't exist the
error is dumped to the error log file:
No manual entry for <some non-existent manpage>
There's an entry in my blog at http://jez.hancock-family.com/ about
exploiting CGI scripts which might be of interest.
--
Jez Hancock
- System Administrator / PHP Developer
http://munk.nu/
http://jez.hancock-family.com/ - Another FreeBSD Diary
http://ipfwstats.sf.net/ - ipfw peruser traffic logging
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org