5 ms·

Found this, looks like a more detailed writeup of whats going on. https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html https://cfreal.githu

by 3ch0 7y ago

Found this, looks like a more detailed writeup of whats going on. https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-local-root.html https://cfreal.github.io/carpe-diem-cve-2019-0211-apache-loc...

ajackfox 7y ago
Probably a stupid question, but are the version #'s mentioned here ( "From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading to an arbitrary function call." ) the only ones affected, or is it possible earlier versions are affected as well? Also, I just want to throw out there that the name of this one is great: "Why the name ? CARPE: stands for CVE-2019-0211 Apache Root Privilege Escalation DIEM: the exploit triggers once a day I had to."
- dspillett 7y ago
  > but are the version #'s mentioned here ... the only ones affected Usually when a range like that is given, yes. > From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019) This case implies that they know the bug was introduced in a particular change, which went public with version 2.4.17 and was either fixed or otherwise mitigated in 2.4.38. The only earlier or other versions that I would expect to see affected are dev/alpha/beta branches.
ec109685 7y ago
This part is concerning: > Apache's team has been prompt to respond and patch, and nice as hell. Really good experience. PHP never answered regarding the UAF.
- Operyl 7y ago
  That’s been my experience reporting any kind of bug with the PHP core team. It really is a pain in the neck.
- hannob 7y ago
  FWIW I reported it to PHPs bugtracker: https://bugs.php.net/bug.php?id=77843 https://bugs.php.net/bug.php?id=77843 I expect that it'll be fixed, not not handled as a security issue, as it doesn't fit within PHPs model of security vulns.
  - jimktrains2 7y ago
    > This looks like it requires specially crafted code, therefore not a security issue. I'm not sure how I feel about such a response. Many exploits require odd, but valid code, and more often than not it exists out there. Also, it feels weird for this to be tagged as a JSON issue?
    - jsight 7y ago
      Basically they don't consider the engineer exploiting the interpreter to be a security vulnerability. That seems a bit dubious, but I can see where they are coming from in treating the script author as a trusted party.

by 3ch0 7y ago

ajackfox 7y ago

Probably a stupid question, but are the version #'s mentioned here ( "From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading to an arbitrary function call." ) the only ones affected, or is it possible earlier versions are affected as well? Also, I just want to throw out there that the name of this one is great: "Why the name ? CARPE: stands for CVE-2019-0211 Apache Root Privilege Escalation DIEM: the exploit triggers once a day I had to."

dspillett 7y ago
> but are the version #'s mentioned here ... the only ones affected Usually when a range like that is given, yes. > From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019) This case implies that they know the bug was introduced in a particular change, which went public with version 2.4.17 and was either fixed or otherwise mitigated in 2.4.38. The only earlier or other versions that I would expect to see affected are dev/alpha/beta branches.

ec109685 7y ago

This part is concerning: > Apache's team has been prompt to respond and patch, and nice as hell. Really good experience. PHP never answered regarding the UAF.

Operyl 7y ago
That’s been my experience reporting any kind of bug with the PHP core team. It really is a pain in the neck.
hannob 7y ago
FWIW I reported it to PHPs bugtracker: https://bugs.php.net/bug.php?id=77843 https://bugs.php.net/bug.php?id=77843 I expect that it'll be fixed, not not handled as a security issue, as it doesn't fit within PHPs model of security vulns.
- jimktrains2 7y ago
  > This looks like it requires specially crafted code, therefore not a security issue. I'm not sure how I feel about such a response. Many exploits require odd, but valid code, and more often than not it exists out there. Also, it feels weird for this to be tagged as a JSON issue?
  - jsight 7y ago
    Basically they don't consider the engineer exploiting the interpreter to be a security vulnerability. That seems a bit dubious, but I can see where they are coming from in treating the script author as a trusted party.