[CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Steven Sim Kok Leong — Tue, 18 Jun 2002 00:52:11 GMT

Re: [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Steven Sim Kok Leong — Thu, 20 Jun 2002 13:15:44 GMT

Hi,

Apache has released a new version of apache which fixes the vulnerabilities:

References:

1) http://httpd.apache.org/info/security_bulletin_20020617.txt

2) http://www.apacheweek.com/issues/02-06-21

Hope this helps. Regards.

Steven Sim Kok Leong

Re: [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Tod Wiederholt — Fri, 21 Jun 2002 12:05:06 GMT

How long will it be before HP releases their patch?

Re: [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Steven Sim Kok Leong — Fri, 21 Jun 2002 23:28:26 GMT

Hi,

To test whether your apache server is vulnerable, just run this command (you will need perl and netcat installed on your server:

# perl -e 'print "POST http://www/index.html HTTP/1.1\r\nAccept: */*\r\nHost: www\r\nContent-Type: application/x-www-form-urlencoded\r\nTransfer-Encoding: chunked\r\nContent-length: 5000\r\n\r\n" . "A"x5000 . "\r\n\r\n"' | nc localhost 80

If it is vulnerable, you will see the following error message in your error log:

# tail -1 /etc/httpd/logs/error_log
[Fri Jun 21 09:18:45 2002] [notice] child pid 14358 exit signal Segmentation fault (11)

Please test your apache vulnerability on your system! And to reiterate the information on the solution, users of Apache 1.3 should upgrade to 1.3.26, and users of Apache 2.0 should upgrade to 2.0.39, which contain a fix for this issue.

According to the code in one of the exploits, it was stated that other OSes are vulnerable (contrary to ISS belief that only some 64-bit Unix and Win32 apache are vulnerable):

* However, contrary to what ISS would have you believe, we have
* successfully exploited this hole on the following operating systems:
*
* Sun Solaris 6-8 (sparc/x86)
* FreeBSD 4.3-4.5 (x86)
* OpenBSD 2.6-3.1 (x86)
* Linux (GNU) 2.4 (x86)

In particular, note that Sun Solaris 6,7,8 on Sparc as well as Linux kernel 2.4 is vulnerable to the exploit.

Hope this helps. Regards.

Steven Sim Kok Leong

topic [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability in Operating System - HP-UX

[CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Re: [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Re: [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability

Re: [CERT Security Bulletin CERT-2002-17] Apache Web Server Chunk Handling Vulnerability