Bug#286225: apache2: environment corruption bug

[Lars Ehrhardt <le-debianbugs@biz.h42.de>]

Package: apache2
Version: 2.0.52-3
Severity: important

Hi,

we've reported this earlier and I thought that a php4 update fixed this
problem. Unfortunately, the bug reappeared this week again.

It seems that there is an environment corruption bug.

Minimal testcase:

Create a php file, umask.php, with:

------------------ snipp --------------------------
<?php
umask(0700);
?>
------------------ snipp --------------------------

Invoke w3m or another browser to open this file
http://<hostname>/umask.php

create a cgi file, test.pl, with:

------------------ snipp --------------------------
#!/usr/bin/perl -w

$counter=`date`;
open(TMP,">/tmp/test.log.$counter");
print TMP "foobar\n\n";
close TMP;
------------------ snipp --------------------------

Request this cgi script a couple of times, e.g:

while true;do wget http://<hostname>/cgi-bin/test.pl;done

The output will look like this:
-rw-r--r--  1 www-data www-data     7 Dec 18 15:27 test.log.Sat Dec 18
15:27:50 CET 2004
-r------w-  1 www-data www-data     7 Dec 18 15:27 test.log.Sat Dec 18
15:27:51 CET 2004

The permissions on the second file are wrong. This behaviour causes all
sorts of funny side effects here. 

The cgi script is probably reusing the apache child environment of the
php script and therefore creates the file with wrong permissions.

We are using the debian testing php4 packages, 4.3.9.

I am not sure, if this is a bug in apache2 or in php4, though. So, feel
free to reassign, if necessary.

Cheers,

Lars

-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing'), (50, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.9-ac15
Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro (charmap=ISO-8859-15)

Versions of packages apache2 depends on:
ii  apache2-mpm-prefork           2.0.52-3   Traditional model for Apache2

-- no debconf information