# Debian bug report logs - #21525
apache: suexec security problem

Package: apache; Severity: important; Reported by: <gorgo@passenger.telnet.hu>; dated Wed, 22 Apr 1998 12:48:02 GMT; Maintainer for apache is Johnie Ingram <johnie@debian.org>.

## Message received at submit@bugs.debian.org:

    Received: (at submit) by bugs.debian.org; 22 Apr 1998 12:37:36 +0000
    Received: (qmail 30694 invoked from network); 22 Apr 1998 12:37:33 -0000
    Received: from passenger.telnet.hu (gorgo@195.8.42.41)
      by debian.novare.net with SMTP; 22 Apr 1998 12:37:33 -0000
    Received: (from gorgo@localhost)
    	by passenger.telnet.hu (8.8.8/8.8.8/Debian/GNU) id OAA22621;
    	Wed, 22 Apr 1998 14:36:53 +0200
    Date: Wed, 22 Apr 1998 14:36:53 +0200
    Message-Id: <199804221236.OAA22621@passenger.telnet.hu>
    From: <gorgo@passenger.telnet.hu>
    Subject: apache: suexec security problem
    To: submit@bugs.debian.org
    X-Mailer: bug 3.1.2

    Package: apache
    Version: 1.3b6-1
    Severity: important

    IIRC previous versions of apache refused to run when there were configuration
    directives requiring suexec wrapper in httpd.conf while suexec was not
    configured properly. 1.3b6 just gives a warning in error log. So if somehow
    suexec lost its setuid bit, all the users' cgis would run with the webserver
    privileges and noone would notice. This is a security risk. So I propose the
    following patch. Please forward it upstream.

    --- http_core.c.save	Wed Apr 22 14:32:46 1998
    +++ http_core.c	Wed Apr 22 14:34:11 1998
    @@ -1346,8 +1346,9 @@
     	else {
     	    cmd->server->server_uid = ap_user_id;
     	    fprintf(stderr,
    -		"Warning: User directive in <VirtualHost> "
    +		"ERROR: User directive in <VirtualHost> "
     		"requires SUEXEC wrapper.\n");
    +	    exit(1);
     	}
         }
     #if !defined (BIG_SECURITY_HOLE) && !defined (__EMX__)
    @@ -1380,7 +1381,8 @@
     	else {
     	    cmd->server->server_gid = ap_group_id;
     	    fprintf(stderr,
    -		    "Warning: Group directive in <VirtualHost> requires SUEXEC wrapper.\n");
    +		    "ERROR: Group directive in <VirtualHost> requires SUEXEC wrapper.\n");
    +	    exit(1);
     	}
         }

    -- System Information
    Debian Release: 2.0 (frozen)
    Kernel Version: Linux passenger 2.0.33 #3 Fri Apr 17 17:11:47 CEST 1998 alpha unknown

    Versions of the packages apache depends on:
    libc6.1	Version: 2.0.7pre1-4
    libgdbmg1	Version: 1.7.3-24
    mime-support	Version: 2.16-1
    perl	Version: 5.004.04-5
    base-passwd	Version: 2.0.3.2

Acknowledgement sent to `<gorgo@passenger.telnet.hu>`:
New bug report received and forwarded. Copy sent to `Johnie Ingram <johnie@debian.org>`. Full text available.

Report forwarded to `debian-bugs-dist@lists.debian.org, Johnie Ingram <johnie@debian.org>`:
`Bug#21525`; Package `apache`. Full text available.

Last modified: 12:39:01 GMT Wed 29 Apr (timestamp page available).