TITLE:
IBM HTTP Server PCRE and Byte-Range Filter Vulnerabilities

SECUNIA ADVISORY ID:
SA17036

VERIFY ADVISORY:
http://secunia.com/advisories/17036/

CRITICAL:
Moderately critical

IMPACT:
Privilege escalation, DoS

WHERE:
>From remote

SOFTWARE:
IBM HTTP Server 2.x
http://secunia.com/product/2236/
IBM Websphere Application Server 4.x
http://secunia.com/product/262/
IBM WebSphere Application Server 5.x
http://secunia.com/product/2614/
IBM WebSphere Application Server 6.x
http://secunia.com/product/4651/

DESCRIPTION:
IBM has acknowledged two vulnerabilities in IBM HTTP Server, which
can be exploited by malicious people to cause a DoS (Denial of
Service), or by malicious, local users to gain escalated privileges
via a specially crafted ".htaccess" file.

For more information:
SA16688
SA16559

NOTE: IBM HTTP Server 2 is bundled with IBM WebSphere Application
Server.

SOLUTION:
The vendor recommends the following directives to be set in
"httpd.conf":
RequestHeader unset range
Header unset Accept-Ranges

There is no workaround for the PCRE integer overflow vulnerability. 
Allow only trusted users to create ".htaccess" files.

ORIGINAL ADVISORY:
http://www-1.ibm.com/support/docview.wss?uid=swg1PK11929

OTHER REFERENCES:
SA16688:
http://secunia.com/advisories/16688/

SA16559:
http://secunia.com/advisories/16559/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------