Topic: CRITICAL exploit on CGI mode PHP

[crazybob]

Yes, that worked for the 2 i-bays i am using the php5-cgi in, but zarafa webaccess .htaccess is in the /usr/share/zarafa-webshare folder. I am not sure how to make the additions activate.

Bob

[madadam]

Yes, that worked for the 2 i-bays i am using the php5-cgi in, but zarafa webaccess .htaccess is in the /usr/share/zarafa-webshare folder 

Ahh, I see. You'll need to create a custom template segment of the /etc/httpd/conf/httpd.conf file in /etc/e-smith/templates-custom/etc/httpd/conf/httpd.conf folder in which you explicitly set AllowOverride All for example:

Code: [Select]

<Directory /usr/share/zarafa-webshare>
  AllowOverride All
  [Other options - see search current httpd.conf file for this segment to see]
</Directory> 

Hope this brief overview helps.

Adam

[crazybob]

I have a fragment that set zarafa webaccess to use php5-cgi

Code: [Select]

<Directory /usr/share/zarafa-webaccess>
       AddHandler php5-cgi .php
       Action php5-cgi /php5-cgi/php-cgi
</Directory>

Should I be able to insert AllowOverride All into this fragment, or will I need to make a new fragment?

[madadam]

I have a fragment that set zarafa webaccess to use php5-cgi

Code: [Select]

<Directory /usr/share/zarafa-webaccess>
       AddHandler php5-cgi .php
       Action php5-cgi /php5-cgi/php-cgi
</Directory>

Should I be able to insert AllowOverride All into this fragment, or will I need to make a new fragment?

Yes, simply add the AllowOverride All parameter to this block and expand the httpd.conf template.

Adam

[crazybob]

I inserted as per discussion, but when I test webaccess, it still shows the source code. I also verified that the suggested code was in the .htaccess file.

Bob

[janet]

crazybob

restart
httpd-e-smith
zarafa
and
php
or just do a reboot

[crazybob]

Thanks Mary, I just preformed an reboot, and no change, it still shows the source code when I test it.

[madadam]

Thanks Mary, I just preformed an reboot, and no change, it still shows the source code when I test it.

OK, first off determine whether or not Apache is reading the .htaccess file. If not you will need to go through and read what's going on in the complete httpd.conf file to make sure nothing is overriding your setting. You could also try doing the mod_rewrite in the httpd.conf custom template segment thereby bypassing the need for a .htaccess file in the first place.

Good luck!

Adam

[madadam]

BTW Bob you could try making *temporary* changes directly to the httpd.conf file, making sure you restart the service as Mary said. It will be a faster way to figure out what's going on. When you've nutted it out then use custom template segments to make the changes permanent.

Adam

[janet]

crazybob

Maybe this is useful
http://wiki.contribs.org/Htaccess

[CharlieBrady]

Adam, how would it be fixed in sme?

There is nothing to fix in SME, as SME does not have this flaw (does not operate PHP in CGI mode).

[CharlieBrady]

You could also try doing the mod_rewrite in the httpd.conf custom template segment thereby bypassing the need for a .htaccess file in the first place.

That's exactly what people should be doing - add the appropriate rewrite entries in the httpd template fragment which enables the php-cgi for particular URLs. .htaccess is only there for people who don't control httpd.conf, or for (probably unsafe) applications which make their own changes on the fly via changes in .htaccess.

[madadam]

That's exactly what people should be doing - add the appropriate rewrite entries in the httpd template fragment which enables the php-cgi for particular URLs. .htaccess is only there for people who don't control httpd.conf, or for (probably unsafe) applications which make their own changes on the fly via changes in .htaccess.

Yes, exactly. Unfortunately I still need to use PHP5-cgi on one of my SME 7 machines, I'm waiting until SME 8 RC 1 before I consider moving everything over to SME 8. Currently I have some machines on SME 8 b7 but only because they can be quickly and easily rebuilt if need be. So fingers crossed!

Thanks for the feedback Charlie!

Adam

[crazybob]

I tried putting the entries in the appropriate fragment, and still no luck. the fragment looks like this now

Code: [Select]

<Directory /usr/share/zarafa-webaccess>
       AddHandler php5-cgi .php
       Action php5-cgi /php5-cgi/php-cgi
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|\- [NC]
RewriteRule .? - [F,L]
</Directory>
Is there anything I am missing?

Bob

[cactus]

I tried putting the entries in the appropriate fragment, and still no luck. the fragment looks like this now

Code: [Select]

<Directory /usr/share/zarafa-webaccess>
       AddHandler php5-cgi .php
       Action php5-cgi /php5-cgi/php-cgi
RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|\- [NC]
RewriteRule .? - [F,L]
</Directory>
Is there anything I am missing?

I don't know, but shouldn't RewriteCond rules and the like not be placed outside Location and Directory blokcks like so?

Code: [Select]

RewriteCond %{QUERY_STRING} ^[^=]*$
RewriteCond %{QUERY_STRING} %2d|\- [NC]
RewriteRule .? - [F,L]

<Directory /usr/share/zarafa-webaccess>
       AddHandler php5-cgi .php
       Action php5-cgi /php5-cgi/php-cgi
</Directory>