exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

HexView Security Advisory 2002-06-05.01

HexView Security Advisory 2002-06-05.01
Posted Jul 16, 2002
Authored by HexView | Site sgi.com

SGI Security Advisory 20020605-01-I - A vulnerability found in the chunked encoding implementation in Apache versions 1.3.24, 2.0.36 or prior can be used to remotely execute code on systems running this software. This vulnerability affects IRIX systems versions 6.5.12m/f up to and including 6.5.16. SGI IRIX 6.5.17 is not affected.

systems | irix
SHA-256 | 76bb676c215a49fb99134bfa0b2bd17ffce8884666531a51a9bc18221c6c10b1

HexView Security Advisory 2002-06-05.01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________
SGI Security Advisory

Title: Apache Web Server Chunk Handling vulnerability
Number: 20020605-01-I
Date: July 12, 2002
Reference: SGI Security Advisory 20020605-01-A
Reference: CERT CA-2002-17
Reference: Apache Security Bulletin 20020617
Reference: CAN-2002-0392
______________________________________________________________________________


- -----------------------
- --- Issue Specifics ---
- -----------------------

This bulletin is an update to SGI Security Advisory 20020605-01-A.

It has been reported that versions of the Apache web server up to and
including 1.3.24 and 2.0 up to and including 2.0.36 contain a bug in the
routines which deal with invalid requests which are encoded using chunked
encoding. This bug can be triggered remotely by sending a carefully crafted
invalid request. This functionality is enabled by default.

See http://httpd.apache.org/info/security_bulletin_20020617.txt for
additional details.

SGI has investigated the issues and recommends the following steps for
neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be
implemented on ALL vulnerable SGI systems.

These issues have been corrected in IRIX 6.5.17, where we are now supplying
a fixed version of Apache. We are also making the fixed version of Apache
available on our security FTP site for prior releases of IRIX.


- --------------
- --- Impact ---
- --------------

The Apache webserver is supplied with IRIX versions since 6.5.12m/f as a
replacement for the older SGI FastTrack server. It is installed by default,
and is enabled through "chkconfig" by default.

In order to determine if the Apache webserver is installed, execute the
following command:

# versions -b | grep apache

If the following line is returned you are OK:

I sgi_apache 07/10/2002 SGI Web Server based on Apache, 1.3.26

But if either of these are returned you are vulnerable:

I sgi_apache 03/20/2001 SGI Apache Server, 1.3.17
I sgi_apache 06/10/2001 SGI Apache Server, 1.3.20
I sgi_apache 12/06/2001 SGI Web Server based on Apache, 1.3.22

These vulnerabilities might lead to a root compromise in some
configurations, and no local account is required.

These vulnerabilities have been publicly discussed in Usenet newsgroups
and mailing lists.

This vulnerability was assigned the following CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392


- ----------------------------
- --- Temporary Workaround ---
- ----------------------------

SGI acknowledges that it may not always be possible to immediately install
patches or upgrade the operating system. In those cases, we recommend
removing the Apache webserver and associated products by using the following
commands:

# versions remove sgi_apache\*
# versions remove websetup\*
# versions remove gateway\*

It is not necessary to reboot the system after doing this. You should
upgrade the operating system as soon as it is possible to do so.


- ----------------
- --- Solution ---
- ----------------

SGI has not provided a patch for these issues, but instead has rolled the
fixed Apache distribution into IRIX 6.5.17 and later releases of the
operating system.

OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 3.x no Note 1
IRIX 4.x no Note 1
IRIX 5.x no Note 1
IRIX 6.0.x no Note 1
IRIX 6.1 no Note 1
IRIX 6.2 no Note 1
IRIX 6.3 no Note 1
IRIX 6.4 no Note 1
IRIX 6.5 no Note 2
IRIX 6.5.1 no Note 2
IRIX 6.5.2 no Note 2
IRIX 6.5.3 no Note 2
IRIX 6.5.4 no Note 2
IRIX 6.5.5 no Note 2
IRIX 6.5.6 no Note 2
IRIX 6.5.7 no Note 2
IRIX 6.5.8 no Note 2
IRIX 6.5.9 no Note 2
IRIX 6.5.10 no Note 2
IRIX 6.5.11 no Note 2
IRIX 6.5.12 yes Note 2
IRIX 6.5.13 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.14 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.15 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.16 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.17 no


NOTES

1) This version of the IRIX operating has been retired. Upgrade to an
actively supported IRIX operating system. See
http://support.sgi.com/irix/news/index.html#policy for more
information.

2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact your
SGI Support Provider or URL: http://support.sgi.com/irix/swupdates/

3) Install sgi_apache 1.3.26 which is supplied with the IRIX 6.5.17
Applications CD or available as sgi_apache-1.3.26.tar from:
ftp://patches.sgi.com/support/free/security/patches/{6.5.13-6.5.16}


##### Patch File Checksums ####

The actual patch will be a tar file containing the following files:

Filename: sgi_apache
Algorithm #1 (sum -r): 24080 5 sgi_apache
Algorithm #2 (sum): 37968 5 sgi_apache
MD5 checksum: 1EE81B8F7A8DF9ED4D9AF507EA1D2755

Filename: sgi_apache.books
Algorithm #1 (sum -r): 65292 3274 sgi_apache.books
Algorithm #2 (sum): 32822 3274 sgi_apache.books
MD5 checksum: CD6296A58A1B6F1FF2D6B212058D1C4D

Filename: sgi_apache.idb
Algorithm #1 (sum -r): 13477 281 sgi_apache.idb
Algorithm #2 (sum): 4276 281 sgi_apache.idb
MD5 checksum: 3144B64008FF66BF858434208C6BCB5B

Filename: sgi_apache.man
Algorithm #1 (sum -r): 29483 97 sgi_apache.man
Algorithm #2 (sum): 35420 97 sgi_apache.man
MD5 checksum: A7864555852DB7ACC913F049BFC46121

Filename: sgi_apache.src
Algorithm #1 (sum -r): 43010 6244 sgi_apache.src
Algorithm #2 (sum): 58317 6244 sgi_apache.src
MD5 checksum: 7D2A6A9A226327D8D9990F80635AED80

Filename: sgi_apache.sw
Algorithm #1 (sum -r): 20406 1852 sgi_apache.sw
Algorithm #2 (sum): 32509 1852 sgi_apache.sw
MD5 checksum: 371625EE5B321A76137AD1A18B23B4C0


- -------------------
- --- Information ---
- -------------------

SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/

SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/

SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/irix/ and ftp://patches.sgi.com/

SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/

SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/

SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/linux/ or
http://oss.sgi.com/projects/sgilinux-combined/download/security-fixes/

SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/nt/

IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/irix/ and ftp://patches.sgi.com/support/patchset/

IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/colls/patches/tools/relstream/index.html

IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/irix/swupdates/

The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com (216.32.174.211). Security advisories and patches are
located under the URL ftp://patches.sgi.com/support/free/security/

For security and patch management reasons, ftp.sgi.com (mirrors
patches.sgi.com security FTP repository) lags behind and does not do a
real-time update.


- ------------------------
- --- Acknowledgments ----
- ------------------------

SGI wishes to thank Mark Litchfield, CERT, ISS and the users of the Internet
Community at large for their assistance in this matter.


- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------

If there are questions about this document, email can be sent to
security-info@sgi.com.

------oOo------

SGI provides security information and patches for use by the entire SGI
community. This information is freely available to any person needing the
information and is available via anonymous FTP and the Web.

The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com (216.32.174.211). Security advisories and patches are
located under the URL ftp://patches.sgi.com/support/free/security/

The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/

For issues with the patches on the FTP sites, email can be sent to
security-info@sgi.com.

For assistance obtaining or working with security patches, please
contact your SGI support provider.

------oOo------

SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email) all
SGI Security Advisories when they are released. Subscribing to the mailing
list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html) or by sending email to
SGI as outlined below.

% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress>
end
^d

In the example above, <YourEmailAddress> is the email address that you wish
the mailing list information sent to. The word end must be on a separate
line to indicate the end of the body of the message. The control-d (^d) is
used to indicate to the mail program that you are finished composing the
mail message.


------oOo------

SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .

------oOo------

If there are general security questions on SGI systems, email can be sent to
security-info@sgi.com.

For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider. A support
contract is not required for submitting a security report.

______________________________________________________________________________
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any
way, SGI is appropriately credited and the document retains and
includes its valid PGP signature.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPS+/UrQ4cFApAP75AQHVJgQApjJG7ZUFT3S/wE7p1khZUiSxBpo1r0qc
inVeNOm1LskJAcr12rVpoKxAvl5UQA1AxeBuDJj1Om5DDN4jHI7mHbTGey4ZdFpJ
6TaewGXadi5xIW75Xh5dFnGYtmRCRSpekSt6VJzVmeYYocmkZyZ/VUjjDo2187Cv
o2LTSqrYsow=
=1pxh
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close