Product: mod_ssl - http://www.modssl.org/ 
Date: 06/24/2002 
Summary: Off-by-one in mod_ssl 2.4.9 and earlier 
By: Frank Denis - j@pureftpd.org 

    --------------------------------------------------------------------- 
                                 DESCRIPTION 
    --------------------------------------------------------------------- 
     
This module provides strong cryptography for the Apache 1.3 webserver via the 
Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) 
protocols by the help of the Open Source SSL/TLS toolkit OpenSSL, which is 
based on SSLeay from Eric A. Young and Tim J. Hudson. 

The mod_ssl package was created in April 1998 by Ralf S. Engelschall and was 
originally derived from software developed by Ben Laurie for use in the 
Apache-SSL HTTP server project. The mod_ssl package is licensed under a 
BSD-style license, which basically means that you are free to get and use it 
for commercial and non-commercial purposes. 

    --------------------------------------------------------------------- 
                                VULNERABILITY 
    --------------------------------------------------------------------- 
     
The Apache web server provides an extended API (EAPI) to easily extended the 
server with third-party modules, through various hooks called as needed. One 
of these hooks, rewrite_command, is called right after a configuration 
directive line was read and before it is processed. 

mod_ssl registers such a rewrite_command hook when backward compatibility is 
enabled. The ssl_compat_directive() is called for every line read in a 
configuration file. 

However, this function contains an off-by-one error in this code snippet : 

  ... 
  char *cp; 
  char caCmd[1024]; 
  char *cpArgs; 
  ... 
  cp = (char *)oline; 
  for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < 1024; ) 
                                                         ^^^^^^^^ 
    caCmd[i++] = *cp++; 
  caCmd[i] = NUL; 
  cpArgs = cp; 
  ... 

oline is a pointer to a line being parsed, and whoose content can be 
arbitrary long, and controlled by untrusted users through ".htaccess" files. 

    --------------------------------------------------------------------- 
                                   IMPACT 
    --------------------------------------------------------------------- 
     
Apart from global configuration files, Apache allows per-directory 
configuration files. Therefore, the bug can be triggered by any regular user 
through specially crafted ".htaccess" files. 

The stack can be smashed. Alexander Yurchenko <grange@rt.mipt.ru> wrote a 
proof of concept exploit for OpenBSD to demonstrate that arbitrary code could 
be executed through ".htaccess" files. 

As noticed by Michal Zalewski <lcamtuf@coredump.cx>, you can cause an 
overflow in every child running to force all of them do what you want. This 
is way more dangerous than children forked for CGI execution. 

Possible implications include denial of service (by sending STOP signals to 
every child), adding fake entries to every log file (not only those from the 
virtualhost the .htaccess lies in), running arbitrary commands as the web 
server user regardless of ExecCGI and suexec settings and spoofing replies. 

    --------------------------------------------------------------------- 
                             VULNERABLE SYSTEMS 
    --------------------------------------------------------------------- 
     
Any system running the Apache web server with mod_ssl compiled in, and the 
"AllowOverride" directive not set to "None" for virtual hosts may be 
vulnerable if virtual hosts are managed by untrusted users. 

Systems may be vulnerable even if no virtual host actually use SSL features, 
as long as mod_ssl is compiled in. 

Apache 2.0 doesn't seem to ship this part of the mod_ssl source code and it 
is therefore not vulnerable. 

mod_ssl compiled without backward compatibility is not vulnerable. However, 
this feature is enabled by default. 

    --------------------------------------------------------------------- 
                                 WORKAROUND 
    --------------------------------------------------------------------- 
     
Disallow per-directory configuration files by only having 
"AllowOverride None" directives in your httpd.conf file, and restart the web 
server. 

    --------------------------------------------------------------------- 
                                    FIXES 
    --------------------------------------------------------------------- 
     
The mod_ssl development team was very reactive and a new version has just 
been released. mod_ssl 2.8.10 addresses the vulnerability and it is 
freely available from http://www.modssl.org/ . Upgrading from an earlier 
release is painless. 

The bug has also been fixed in OpenBSD-current, thanks to fgsch. 

The following oneliner patch also addresses the problem : 

--- pkg.sslmod/ssl_engine_compat.c.orig Sat Feb 23 19:45:23 2002 
+++ pkg.sslmod/ssl_engine_compat.c Mon Jun 24 20:43:17 2002 
@@ -309,7 +309,7 @@ 
      * Extract directive name 
      */ 
     cp = (char *)oline; 
- for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < 1024; ) 
+ for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < sizeof(caCmd) - 1; ) 
         caCmd[i++] = *cp++; 
     caCmd[i] = NUL; 
     cpArgs = cp; 

Best regards, 

     -Frank. 

-- 
 __  /*-      Frank DENIS (Jedi/Sector One) <j@42-Networks.Com>     -*\  __
 \ '/     Secure FTP Server     \' /
  \/   Misc. free software   \/