{"id":101561,"date":"2021-10-07T10:23:03","date_gmt":"2021-10-07T08:23:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-php-pozvolyayushhaya-obojti-ogranicheniya-zadannye-v-php-ini"},"modified":"2021-10-07T10:23:03","modified_gmt":"2021-10-07T08:23:03","slug":"uyazvimost-v-php-pozvolyayushhaya-obojti-ogranicheniya-zadannye-v-php-ini","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-php-pozvolyayushhaya-obojti-ogranicheniya-zadannye-v-php-ini","title":{"rendered":"Vulnerabilitate \u00een PHP, care permite ocolirea restric\u021biilor stabilite \u00een php.ini","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A fost publicat\u0103 o metod\u0103 de o ocolire \u00een interpretatorul PHP a restric\u021biilor impuse prin directiva disable_functions \u0219i alte set\u0103ri din php.ini. Reamintim c\u0103 directiva disable_functions permite interzicerea utiliz\u0103rii \u00een scripturi a anumitor func\u021bii interne, de exemplu, se pot interzice \u201esystem, exec, passthru, popen, proc_open \u0219i shell_exec\u201d pentru blocarea apelurilor externe de programe sau fopen pentru a interzice deschiderea fi\u0219ierelor. <\/p>\n

Este demn de men\u021bionat c\u0103 \u00een exploatul propus este utilizat\u0103 o vulnerabilitate despre care dezvoltatorii PHP au fost informa\u021bi cu mai mult de 10 ani \u00een urm\u0103, dar au considerat-o o problem\u0103 nesemnificativ\u0103, care nu afecteaz\u0103 securitatea. Metoda de atac propus\u0103 se bazeaz\u0103 pe modificarea valorilor parametrilor \u00een memoria procesului \u0219i func\u021bioneaz\u0103 \u00een toate versiunile actuale de PHP, \u00eencep\u00e2nd cu PHP 7.0 (atacul este posibil \u0219i pe PHP 5.x, dar pentru aceasta sunt necesare modific\u0103ri \u00een exploat). Exploatul a fost testat \u00een diferite configura\u021bii Debian, Ubuntu, CentOS \u0219i FreeBSD cu PHP \u00een forma cli, fpm \u0219i modul pentru apache2.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043c\u0435\u0442\u043e\u0434 \u043e\u0431\u0445\u043e\u0434\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0435 PHP \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u044b disable_functions \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0432 php.ini. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u0430 disable_functions \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u0445 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c «system, exec, passthru, popen, proc_open \u0438 shell_exec» \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u044b\u0437\u043e\u0432\u0430 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0438\u043b\u0438 fopen \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u0435\u0442\u0430 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0432 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101561","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een PHP, ce permite o ocolire a restric\u021biilor impuse \u00een php.ini | ProHoster","description":"A fost publicat\u0103 o metod\u0103 de o ocolire \u00een interpretatorul PHP a restric\u021biilor impuse prin directiva disable_functions \u0219i alte set\u0103ri din php.ini.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-php-pozvolyayushhaya-obojti-ogranicheniya-zadannye-v-php-ini","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 PHP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0432 php.ini | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043c\u0435\u0442\u043e\u0434 \u043e\u0431\u0445\u043e\u0434\u0430 \u0432 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0435 PHP \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u044b disable_functions \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0432 php.ini.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-php-pozvolyayushhaya-obojti-ogranicheniya-zadannye-v-php-ini","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-07T08:23:03+00:00","article:modified_time":"2021-10-07T08:23:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101561","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-07 08:25:37","updated":"2022-10-02 22:34:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101561"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101561\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}