[cobalt-users] PHP Vulnerability found

[Aussie Hosts <support@xxxxxxxxxxxxxxx>]

Greetings all

We recently found a rather large exploitable hole within the .pkg package
available from the Cobalt website for PHP. It allows the user that PHP is
run as to su without permissions and run commands at a system level. Using
it we were able to create a file on / as a standard user using a simple PHP
command runner with a shell script. This obviously is a massive hole as it
opens your system up to any user who would like to run rm -fr / with root
privileges.

To fix it we applied the following countermeasures;

1) We chowned /bin/su to root.admin

2) Modified php.ini (located in /etc/httpd/php.ini) so that Safe Mode was
enabled by default (by default it is off)

This is obviously a very large bug on Cobalts behalf which has left a gaping
security hole particularly with regards to running PHP in safe mode.

-- 
Kind regards,

Aussie Hosts
An EDIT Group Division