PHP LiteSpeed SAPI secret key improper disposal Jan 25 2016 03:58PM
Imre RAD (imre rad search-lab hu)
In suEXEC_Daemon mode of the LiteSpeed web server spawns one PHP master
process during startup. It is running as root and accepts LSAPI
requests, which in turn specify what user under the script should run.
The LSAPI request is authenticated with a MAC, which is based on
preshared random key between the the PHP and the web server.

We found, the Litespeed PHP SAPI module did not clear this secret in its
child processes so it was available in the PHP process memory space of
the child processes.

The fix is available with the commit
The fixed versions of PHP are: 5.5.31, 5.6.17 and 7.0.2.

More information:

Imre Rad
Search-Lab Ltd.

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus