Hey Bill
just to clarify these are LOCAL DoS attacks? ie you need access to the
machine (or the ability to execute php) in order for this to be an issue?
William A. Rowe, Jr. wrote:
Published - ergo moving discussion from security@ to [EMAIL PROTECTED]
Of course if in the course of this discussion, you uncover a new
edge case, feel free to move that thread back to [EMAIL PROTECTED]
to discuss your new discovery.
------------------------------------------------------------------------
Subject:
Apache httpd vulenrabilities
From:
Blazej Miga <[EMAIL PROTECTED]>
Date:
Tue, 29 May 2007 20:00:42 +0200 (CEST)
To:
[EMAIL PROTECTED]
To:
[EMAIL PROTECTED]
PSNC Security Team has got the pleasure to announce that, as a result
of Apache httpd server (ver. 1.3.x, 2.0.x and 2.2.x) source code
analysis, several vulnerabilities have been found that make it
possible to perfom a DoS attack against the services and the system
that the application is running on. Below the basic information on
found vulnerabilities may be found:
Vuln#1
Httpd Server DoS
Test environment: ver. 2.0.59, 2.2.4, prefork mpm module
An appropriate code run in the worker process context makes it
possible to kill all worker processes with simultaneous blocking of
creating new worker processes by the master process. As a result, the
server stops to accept and handle new connections.
Vuln #2
SIGUSR1 killer
Test environment: ver. 2.0.59, 2.2.4 prefork mpm module
An appropriate code run in the worker process context makes it
possible to send SIGUSR1 signals by the master process (that runs with
root credentials) to an arbitrary process within the system.
Vuln #3
SIGUSR1 killer
Test environment: ver 1.3.37
An appropriate code run in the worker process context makes it
possible to send SIGUSR1 signals by the master process (that runs with
root credentials) to an arbitrary process within the system.
Vuln #4
System DoS
Test environment: ver 2.0.59, 2.2.4 prefork mpm module
An appropriate code run in the worker process context makes it
possible to force the master process to create an unlimited amount of
new worker processes. As a result, the activity of the whole system
may be blocked.
Countermeasures:
Disabling the possibility of running the user.s code in the worker
process context. An especial emphasis should be put on programming
languages that may be configures as an Apache module (like mod_php,
mod_perl etc.) in order to block dangerous functions, e.g. dl(),
dlopen().
The information on the vulnerabilities above was sent to Apache
Software Foundation on 16 May, 2006. For over 1 year no official patch
has been issued. PSNC Security Team is currently working on its own,
unofficial patches. Our patches will be published on 18 June, 2007 on
the team webpage (http://security.psnc.pl). On 20 June, 2007 the
detailed information on the found vulnerabilities will be issued.
PSNC Security Team