CVE-2014-0185: Improper Privilege Management (CWE-269)
value: sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Published: 2014-05-06T10:44Z
Repository: https://github.com/php/php-src
Language: Other
Files changed: NEWS, sapi/fpm/fpm/fpm_unix.c, sapi/fpm/php-fpm.conf.in
Commit date: 2014-04-29 09:14:11 -0700
Commit message: Fix bug #67060: use default mode of 660

Diff: diff --git a/NEWS b/NEWS
index 387d070c028..104279441a7 100644
--- a/NEWS
+++ b/NEWS
@@ -23,11 +23,11 @@ PHP                                                                        NEWS
 
 - Phar:
   . Fix bug #64498 ($phar->buildFromDirectory can't compress file with an accent 
     in its name). (PR #588) 
 
-?? ??? 2014, PHP 5.4.28
+01 May 2014, PHP 5.4.28
 
 - Core:
   . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
   . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
     UNIX sockets). (Mike)
@@ -53,10 +53,12 @@ PHP                                                                        NEWS
   . Fixed bug #66987 (Memory corruption in fileinfo ext / bigendian).
     (Remi)
 
 - FPM:
   . Fixed bug #66482 (unknown entry 'priority' in php-fpm.conf). 
+  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure 
+    default configuration) (CVE-2014-0185). (Stas)
 
 - JSON:
   . Fixed bug #66021 (Blank line inside empty array/object when
     JSON_PRETTY_PRINT is set). (Kevin Israel)
 
diff --git a/sapi/fpm/fpm/fpm_unix.c b/sapi/fpm/fpm/fpm_unix.c
index 48249e8a494..ea0e67369cd 100644
--- a/sapi/fpm/fpm/fpm_unix.c
+++ b/sapi/fpm/fpm/fpm_unix.c
@@ -33,11 +33,11 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */
 	struct fpm_worker_pool_config_s *c = wp->config;
 
 	/* uninitialized */
 	wp->socket_uid = -1;
 	wp->socket_gid = -1;
-	wp->socket_mode = 0666;
+	wp->socket_mode = 0660;
 
 	if (!c) {
 		return 0;
 	}
 
diff --git a/sapi/fpm/php-fpm.conf.in b/sapi/fpm/php-fpm.conf.in
index 1e70f2c1c1e..9205d422399 100644
--- a/sapi/fpm/php-fpm.conf.in
+++ b/sapi/fpm/php-fpm.conf.in
@@ -164,14 +164,14 @@ listen = 127.0.0.1:9000
 
 ; Set permissions for unix socket, if one is used. In Linux, read/write
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions. 
 ; Default Values: user and group are set as the running user
-;                 mode is set to 0666
+;                 mode is set to 0660
 ;listen.owner = @php_fpm_user@
 ;listen.group = @php_fpm_group@
-;listen.mode = 0666
+;listen.mode = 0660
  
 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
 ; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
 ; must be separated by a comma. If this value is left blank, connections will be

Vulnerable code: ?? ??? 2014, PHP 5.4.28
	wp->socket_mode = 0666;
;                 mode is set to 0666
;listen.mode = 0666
Fixed code: 01 May 2014, PHP 5.4.28
  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure 
    default configuration) (CVE-2014-0185). (Stas)
	wp->socket_mode = 0660;
;                 mode is set to 0660
;listen.mode = 0660