Before everyone gets too excited, you may just want to have a look at apache's own website re this issue.
You might also be interested in this take on the matter. http://apache.slashdot.org/article.pl?sid=02/06/17/1948249&mode=thread&tid=172 I think I'll believe the guys that actually wrote the software. Oliver ----- Forwarded by Oliver Friesen/AUST/CSC on 19/06/2002 08:23 ----- Sidney Witzer <sidney.witzer@ci To: [EMAIL PROTECTED] ticorp.com> cc: Sent by: Subject: [Fwd: *** AlertCon 2 - Updated Internet Risk Advisory 06-17-2002 ***] owner-issforum@is s.net 18/06/2002 07:52 Does this bug affect the version of Apache distributed with the System Scanner Vista product? Sid Witzer Citigroup "Gray, Patrick (ISS Atlanta)" wrote: > > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! > ---------------------------------------------------------------------------- > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > UPDATED INTERNET RISK ADVISORY for 06-17-2002 > ISS X-Force Internet Threat Intelligence Center > > www.iss.net - Click on the AlertCon logo for more information. > > ******************************************** > ALERTCON 2 > Projected: AlertCon 2 > ******************************************** > > ALERTCON 2 - We have raised the AlertCon to 2 to advise of a serious > vulnerability discovered by ISS X-Force. > > Internet Security Systems Security Advisory > > June 17, 2002 > > Remote Compromise Vulnerability in Apache HTTP Server > > Synopsis: > > > ISS X-Force has discovered a serious vulnerability in the default > version of Apache HTTP Server. Apache is the most popular Web server > and > is used on over half of all Web servers on the Internet. It may be > possible for remote attackers to exploit this vulnerability to > compromise Apache Web servers. Successful exploitation may lead to > modified Web content, denial of service, or further compromise. > > > > Affected Versions: > > Apache 1.x > > Note: Many commercial Web Application Servers such as Oracle 9ias and > IBM Websphere use Apache HTTP Server to process HTTP requests. > Additional products that bundle Apache HTTP Server for Windows may be > affected. > > Description: > > The Apache HTTP Server is maintained by the Apache Software > Foundation. > Apache is an extremely popular open-source Web server. Netcraft > (http://www.netcraft.com) reports that as of May 2002, Apache > accounts > for over 63% of all active Web sites. Apache's installed base is > larger > than all other Web servers combined. > > The Apache Project is an open-source and volunteer collaboration > aimed > to create and maintain a free, feature-rich, powerful, and secure Web > server implementation. Apache is well regarded as the best, freely > available Web server. > > Apache contains a flawed mechanism meant to calculate the size of > "chunked" encoding. Chunked encoding is part of the HTTP Protocol > Specification used for accepting data from Web users. When data is > sent > from the user, the Web server needs to allocate a memory buffer of a > certain size to hold the submitted data. When the size of the data > being > submitted is unknown, the client or Web browser will communicate with > the server by creating "chunks" of data of a negotiated size. > > > The Apache HTTP Server has a software flaw that misinterprets the > size > of incoming data chunks. This error may lead to a signal race, heap > overflow, and to exploitation of malicious code. > > > X-Force has verified that this issue is exploitable on Apache for > Windows (Win32) version 1.3.24. Apache 1.x for Unix contains the same > source code, but X-Force believes that successful exploitation on > most > Unix platforms is unlikely. > > > Recommendations: > > Internet Scanner X-Press Update 6.12 includes a check, > ApacheChunkedEncodingBo, to detect installations of Apache HTTP > Server > for Win32. XPU 6.12 is available from the ISS Download Center at: > http://www.iss.net/download. For questions about downloading and > installing this XPU, email [EMAIL PROTECTED] > > > Detection support for this attack will be included in future X-Press > Updates for RealSecure Network Sensor 6.x and 7.0. These XPUs will be > available from the ISS Download Center, and this alert will be > updated > when these updates become available. > > > ISS X-Force has developed a patch for this issue. Follow the > instructions below, or contact your vendor for assistance: > > To apply a source code patch to your Apache package: > > 1. Locate your source directory and navigate into the "main" sub- > directory. > > 2. Verify that "http_protocol.c" is present in the current directory. > > 3. To update your http_protocol.c file, create a file named > "apache_patch.diff", containing the following text: > > - --- http_protocol.c.vuln Fri Jun 14 16:12:50 2002 > > +++ http_protocol.c Fri Jun 14 16:13:47 2002 > > @@ -2171,7 +2171,7 @@ > > /* Otherwise, we are in the midst of reading a chunk of data */ > > - - len_to_read = (r->remaining > bufsiz) ? bufsiz : r->remaining; > > + len_to_read = (r->remaining > (unsigned int)bufsiz) ? bufsiz : > r-> > > remaining; > > len_read = ap_bread(r->connection->client, buffer, len_to_read); > > if (len_read <= 0) { > > > > 4. Apply the source code update using the "patch" command, or a > similar > utility. > > 5. Build new binaries and reinstall. > > The Apache Server Project has been notified and will make a formal > patch > available soon. Please refer to the Apache Server Project's homepage > for > more information: http://httpd.apache.org/ > > > Additional Information: > > http://www.iss.net/security_center > > http://www.apache.org > > http://httpd.apache.org/ > > > > Credits: > > This vulnerability was discovered and researched by Neel Mehta of the > ISS X-Force. > > > Patrick Gray > Manager, X-Force > Internet Threat Intelligence Center > Internet Security Systems > 6303 Barfield Road > Atlanta, GA 30328 > > -----BEGIN PGP SIGNATURE----- > Version: PGP 7.1.1 > > iQA/AwUBPQ4H4ZG41ROSQPncEQL3uwCg4q/7ELQs5TgXI/Cn6ejatMM6Z1wAoIRu > J1cRmX5u2ISjlPLOZz5qxfLy > =LfEz > -----END PGP SIGNATURE----- "Gray, Patrick (ISS Atlanta)" wrote: > > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! > ---------------------------------------------------------------------------- > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > UPDATED INTERNET RISK ADVISORY for 06-17-2002 > ISS X-Force Internet Threat Intelligence Center > > www.iss.net - Click on the AlertCon logo for more information. > > ******************************************** > ALERTCON 2 > Projected: AlertCon 2 > ******************************************** > > ALERTCON 2 - We have raised the AlertCon to 2 to advise of a serious > vulnerability discovered by ISS X-Force. > > Internet Security Systems Security Advisory > > June 17, 2002 > > Remote Compromise Vulnerability in Apache HTTP Server > > Synopsis: > > > ISS X-Force has discovered a serious vulnerability in the default > version of Apache HTTP Server. Apache is the most popular Web server > and > is used on over half of all Web servers on the Internet. It may be > possible for remote attackers to exploit this vulnerability to > compromise Apache Web servers. Successful exploitation may lead to > modified Web content, denial of service, or further compromise. > > > > Affected Versions: > > Apache 1.x > > Note: Many commercial Web Application Servers such as Oracle 9ias and > IBM Websphere use Apache HTTP Server to process HTTP requests. > Additional products that bundle Apache HTTP Server for Windows may be > affected. > > Description: > > The Apache HTTP Server is maintained by the Apache Software > Foundation. > Apache is an extremely popular open-source Web server. Netcraft > (http://www.netcraft.com) reports that as of May 2002, Apache > accounts > for over 63% of all active Web sites. Apache's installed base is > larger > than all other Web servers combined. > > The Apache Project is an open-source and volunteer collaboration > aimed > to create and maintain a free, feature-rich, powerful, and secure Web > server implementation. Apache is well regarded as the best, freely > available Web server. > > Apache contains a flawed mechanism meant to calculate the size of > "chunked" encoding. Chunked encoding is part of the HTTP Protocol > Specification used for accepting data from Web users. When data is > sent > from the user, the Web server needs to allocate a memory buffer of a > certain size to hold the submitted data. When the size of the data > being > submitted is unknown, the client or Web browser will communicate with > the server by creating "chunks" of data of a negotiated size. > > > The Apache HTTP Server has a software flaw that misinterprets the > size > of incoming data chunks. This error may lead to a signal race, heap > overflow, and to exploitation of malicious code. > > > X-Force has verified that this issue is exploitable on Apache for > Windows (Win32) version 1.3.24. Apache 1.x for Unix contains the same > source code, but X-Force believes that successful exploitation on > most > Unix platforms is unlikely. > > > Recommendations: > > Internet Scanner X-Press Update 6.12 includes a check, > ApacheChunkedEncodingBo, to detect installations of Apache HTTP > Server > for Win32. XPU 6.12 is available from the ISS Download Center at: > http://www.iss.net/download. For questions about downloading and > installing this XPU, email [EMAIL PROTECTED] > > > Detection support for this attack will be included in future X-Press > Updates for RealSecure Network Sensor 6.x and 7.0. These XPUs will be > available from the ISS Download Center, and this alert will be > updated > when these updates become available. > > > ISS X-Force has developed a patch for this issue. Follow the > instructions below, or contact your vendor for assistance: > > To apply a source code patch to your Apache package: > > 1. Locate your source directory and navigate into the "main" sub- > directory. > > 2. Verify that "http_protocol.c" is present in the current directory. > > 3. To update your http_protocol.c file, create a file named > "apache_patch.diff", containing the following text: > > - --- http_protocol.c.vuln Fri Jun 14 16:12:50 2002 > > +++ http_protocol.c Fri Jun 14 16:13:47 2002 > > @@ -2171,7 +2171,7 @@ > > /* Otherwise, we are in the midst of reading a chunk of data */ > > - - len_to_read = (r->remaining > bufsiz) ? bufsiz : r->remaining; > > + len_to_read = (r->remaining > (unsigned int)bufsiz) ? bufsiz : > r-> > > remaining; > > len_read = ap_bread(r->connection->client, buffer, len_to_read); > > if (len_read <= 0) { > > > > 4. Apply the source code update using the "patch" command, or a > similar > utility. > > 5. Build new binaries and reinstall. > > The Apache Server Project has been notified and will make a formal > patch > available soon. Please refer to the Apache Server Project's homepage > for > more information: http://httpd.apache.org/ > > > Additional Information: > > http://www.iss.net/security_center > > http://www.apache.org > > http://httpd.apache.org/ > > > > Credits: > > This vulnerability was discovered and researched by Neel Mehta of the > ISS X-Force. > > > Patrick Gray > Manager, X-Force > Internet Threat Intelligence Center > Internet Security Systems > 6303 Barfield Road > Atlanta, GA 30328 > > -----BEGIN PGP SIGNATURE----- > Version: PGP 7.1.1 > > iQA/AwUBPQ4H4ZG41ROSQPncEQL3uwCg4q/7ELQs5TgXI/Cn6ejatMM6Z1wAoIRu > J1cRmX5u2ISjlPLOZz5qxfLy > =LfEz > -----END PGP SIGNATURE----- "Gray, Patrick (ISS Atlanta)" wrote: > > TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to > [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! > ---------------------------------------------------------------------------- > > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > UPDATED INTERNET RISK ADVISORY for 06-17-2002 > ISS X-Force Internet Threat Intelligence Center > > www.iss.net - Click on the AlertCon logo for more information. > > ******************************************** > ALERTCON 2 > Projected: AlertCon 2 > ******************************************** > > ALERTCON 2 - We have raised the AlertCon to 2 to advise of a serious > vulnerability discovered by ISS X-Force. > > Internet Security Systems Security Advisory > > June 17, 2002 > > Remote Compromise Vulnerability in Apache HTTP Server > > Synopsis: > > > ISS X-Force has discovered a serious vulnerability in the default > version of Apache HTTP Server. Apache is the most popular Web server > and > is used on over half of all Web servers on the Internet. It may be > possible for remote attackers to exploit this vulnerability to > compromise Apache Web servers. Successful exploitation may lead to > modified Web content, denial of service, or further compromise. > > > > Affected Versions: > > Apache 1.x > > Note: Many commercial Web Application Servers such as Oracle 9ias and > IBM Websphere use Apache HTTP Server to process HTTP requests. > Additional products that bundle Apache HTTP Server for Windows may be > affected. > > Description: > > The Apache HTTP Server is maintained by the Apache Software > Foundation. > Apache is an extremely popular open-source Web server. Netcraft > (http://www.netcraft.com) reports that as of May 2002, Apache > accounts > for over 63% of all active Web sites. Apache's installed base is > larger > than all other Web servers combined. > > The Apache Project is an open-source and volunteer collaboration > aimed > to create and maintain a free, feature-rich, powerful, and secure Web > server implementation. Apache is well regarded as the best, freely > available Web server. > > Apache contains a flawed mechanism meant to calculate the size of > "chunked" encoding. Chunked encoding is part of the HTTP Protocol > Specification used for accepting data from Web users. When data is > sent > from the user, the Web server needs to allocate a memory buffer of a > certain size to hold the submitted data. When the size of the data > being > submitted is unknown, the client or Web browser will communicate with > the server by creating "chunks" of data of a negotiated size. > > > The Apache HTTP Server has a software flaw that misinterprets the > size > of incoming data chunks. This error may lead to a signal race, heap > overflow, and to exploitation of malicious code. > > > X-Force has verified that this issue is exploitable on Apache for > Windows (Win32) version 1.3.24. Apache 1.x for Unix contains the same > source code, but X-Force believes that successful exploitation on > most > Unix platforms is unlikely. > > > Recommendations: > > Internet Scanner X-Press Update 6.12 includes a check, > ApacheChunkedEncodingBo, to detect installations of Apache HTTP > Server > for Win32. XPU 6.12 is available from the ISS Download Center at: > http://www.iss.net/download. For questions about downloading and > installing this XPU, email [EMAIL PROTECTED] > > > Detection support for this attack will be included in future X-Press > Updates for RealSecure Network Sensor 6.x and 7.0. These XPUs will be > available from the ISS Download Center, and this alert will be > updated > when these updates become available. > > > ISS X-Force has developed a patch for this issue. Follow the > instructions below, or contact your vendor for assistance: > > To apply a source code patch to your Apache package: > > 1. Locate your source directory and navigate into the "main" sub- > directory. > > 2. Verify that "http_protocol.c" is present in the current directory. > > 3. To update your http_protocol.c file, create a file named > "apache_patch.diff", containing the following text: > > - --- http_protocol.c.vuln Fri Jun 14 16:12:50 2002 > > +++ http_protocol.c Fri Jun 14 16:13:47 2002 > > @@ -2171,7 +2171,7 @@ > > /* Otherwise, we are in the midst of reading a chunk of data */ > > - - len_to_read = (r->remaining > bufsiz) ? bufsiz : r->remaining; > > + len_to_read = (r->remaining > (unsigned int)bufsiz) ? bufsiz : > r-> > > remaining; > > len_read = ap_bread(r->connection->client, buffer, len_to_read); > > if (len_read <= 0) { > > > > 4. Apply the source code update using the "patch" command, or a > similar > utility. > > 5. Build new binaries and reinstall. > > The Apache Server Project has been notified and will make a formal > patch > available soon. Please refer to the Apache Server Project's homepage > for > more information: http://httpd.apache.org/ > > > Additional Information: > > http://www.iss.net/security_center > > http://www.apache.org > > http://httpd.apache.org/ > > > > Credits: > > This vulnerability was discovered and researched by Neel Mehta of the > ISS X-Force. > > > Patrick Gray > Manager, X-Force > Internet Threat Intelligence Center > Internet Security Systems > 6303 Barfield Road > Atlanta, GA 30328 > > -----BEGIN PGP SIGNATURE----- > Version: PGP 7.1.1 > > iQA/AwUBPQ4H4ZG41ROSQPncEQL3uwCg4q/7ELQs5TgXI/Cn6ejatMM6Z1wAoIRu > J1cRmX5u2ISjlPLOZz5qxfLy > =LfEz > -----END PGP SIGNATURE----- **************************** -------- Original Message -------- Subject: *** AlertCon 2 - Updated Internet Risk Advisory 06-17-2002 *** Date: Mon, 17 Jun 2002 12:01:38 -0400 From: "Gray, Patrick (ISS Atlanta)" <[EMAIL PROTECTED]> To: "Gray, Patrick (ISS Atlanta)" <[EMAIL PROTECTED]> TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 UPDATED INTERNET RISK ADVISORY for 06-17-2002 ISS X-Force Internet Threat Intelligence Center www.iss.net - Click on the AlertCon logo for more information. ******************************************** ALERTCON 2 Projected: AlertCon 2 ******************************************** ALERTCON 2 - We have raised the AlertCon to 2 to advise of a serious vulnerability discovered by ISS X-Force. Internet Security Systems Security Advisory June 17, 2002 Remote Compromise Vulnerability in Apache HTTP Server Synopsis: ISS X-Force has discovered a serious vulnerability in the default version of Apache HTTP Server. Apache is the most popular Web server and is used on over half of all Web servers on the Internet. It may be possible for remote attackers to exploit this vulnerability to compromise Apache Web servers. Successful exploitation may lead to modified Web content, denial of service, or further compromise. Affected Versions: Apache 1.x Note: Many commercial Web Application Servers such as Oracle 9ias and IBM Websphere use Apache HTTP Server to process HTTP requests. Additional products that bundle Apache HTTP Server for Windows may be affected. Description: The Apache HTTP Server is maintained by the Apache Software Foundation. Apache is an extremely popular open-source Web server. Netcraft (http://www.netcraft.com) reports that as of May 2002, Apache accounts for over 63% of all active Web sites. Apache's installed base is larger than all other Web servers combined. The Apache Project is an open-source and volunteer collaboration aimed to create and maintain a free, feature-rich, powerful, and secure Web server implementation. Apache is well regarded as the best, freely available Web server. Apache contains a flawed mechanism meant to calculate the size of "chunked" encoding. Chunked encoding is part of the HTTP Protocol Specification used for accepting data from Web users. When data is sent from the user, the Web server needs to allocate a memory buffer of a certain size to hold the submitted data. When the size of the data being submitted is unknown, the client or Web browser will communicate with the server by creating "chunks" of data of a negotiated size. The Apache HTTP Server has a software flaw that misinterprets the size of incoming data chunks. This error may lead to a signal race, heap overflow, and to exploitation of malicious code. X-Force has verified that this issue is exploitable on Apache for Windows (Win32) version 1.3.24. Apache 1.x for Unix contains the same source code, but X-Force believes that successful exploitation on most Unix platforms is unlikely. Recommendations: Internet Scanner X-Press Update 6.12 includes a check, ApacheChunkedEncodingBo, to detect installations of Apache HTTP Server for Win32. XPU 6.12 is available from the ISS Download Center at: http://www.iss.net/download. For questions about downloading and installing this XPU, email [EMAIL PROTECTED] Detection support for this attack will be included in future X-Press Updates for RealSecure Network Sensor 6.x and 7.0. These XPUs will be available from the ISS Download Center, and this alert will be updated when these updates become available. ISS X-Force has developed a patch for this issue. Follow the instructions below, or contact your vendor for assistance: To apply a source code patch to your Apache package: 1. Locate your source directory and navigate into the "main" sub- directory. 2. Verify that "http_protocol.c" is present in the current directory. 3. To update your http_protocol.c file, create a file named "apache_patch.diff", containing the following text: - --- http_protocol.c.vuln Fri Jun 14 16:12:50 2002 +++ http_protocol.c Fri Jun 14 16:13:47 2002 @@ -2171,7 +2171,7 @@ /* Otherwise, we are in the midst of reading a chunk of data */ - - len_to_read = (r->remaining > bufsiz) ? bufsiz : r->remaining; + len_to_read = (r->remaining > (unsigned int)bufsiz) ? bufsiz : r-> remaining; len_read = ap_bread(r->connection->client, buffer, len_to_read); if (len_read <= 0) { 4. Apply the source code update using the "patch" command, or a similar utility. 5. Build new binaries and reinstall. The Apache Server Project has been notified and will make a formal patch available soon. Please refer to the Apache Server Project's homepage for more information: http://httpd.apache.org/ Additional Information: http://www.iss.net/security_center http://www.apache.org http://httpd.apache.org/ Credits: This vulnerability was discovered and researched by Neel Mehta of the ISS X-Force. Patrick Gray Manager, X-Force Internet Threat Intelligence Center Internet Security Systems 6303 Barfield Road Atlanta, GA 30328 -----BEGIN PGP SIGNATURE----- Version: PGP 7.1.1 iQA/AwUBPQ4H4ZG41ROSQPncEQL3uwCg4q/7ELQs5TgXI/Cn6ejatMM6Z1wAoIRu J1cRmX5u2ISjlPLOZz5qxfLy =LfEz -----END PGP SIGNATURE----- (See attached file: smime.p7s)
smime.p7s
Description: Binary data
