what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Apache 2.2.14 mod_isapi Dangling Pointer

Apache 2.2.14 mod_isapi Dangling Pointer
Posted Mar 6, 2010
Authored by Brett Gervasoni | Site senseofsecurity.com.au

By sending a specially crafted request followed by a reset packet it is possible to trigger a vulnerability in Apache 2.2.14 mod_isapi that will unload the target ISAPI module from memory. However function pointers still remain in memory and are called when published ISAPI functions are referenced. This results in a dangling pointer vulnerability. Successful exploitation results in the execution of arbitrary code with SYSTEM privileges.

tags | advisory, arbitrary
advisories | CVE-2010-0425
SHA-256 | 90f73578fb832e46f16d36335ab9911e89d608d85ddf6502b6fd7c3f8e006935

Apache 2.2.14 mod_isapi Dangling Pointer

Change Mirror Download
Apache mod_isapi Dangling Pointer Vulnerability - Security Advisory - 
SOS-10-002

Release Date. 5-Mar-2010
Last Update. -
Vendor Notification Date. 9-Feb-2010
Product. Apache HTTP Server
Platform. Microsoft Windows
Affected versions. 2.2.14 verified and
possibly others.
Severity Rating. High
Impact. System access
Attack Vector. Remote
Solution Status. Upgrade to 2.2.15 (as advised by
Apache)
CVE reference. CVE-2010-0425

Details.
The Apache HTTP Server, commonly referred to as Apache, is a
popular open source web server software. mod_isapi is a core
module of the Apache package that implements the Internet Server
extension API. The extension allows Apache to serve Internet
Server extensions (ISAPI .dll modules) for Microsoft Windows
based hosts.

By sending a specially crafted request followed by a reset packet
it is possible to trigger a vulnerability in Apache mod_isapi
that will unload the target ISAPI module from memory. However
function pointers still remain in memory and are called when
published ISAPI functions are referenced. This results in a
dangling pointer vulnerability.

Successful exploitation results in the execution of arbitrary
code with SYSTEM privileges.

Proof of Concept.
Proof of concept code is available for this vulnerability. The
payload will write a text file (sos.txt) to the Apache working
directory demonstrating that code execution is possible. The
code can be downloaded from the following link:

http://www.senseofsecurity.com.au/advisories/SOS-10-002-pwn-isapi.cpp

Furthermore, a video demonstrating the exploitation of this
vulnerability using a bind shell has been created. It can be viewed at the
following link:
http://www.senseofsecurity.com.au/movies/SOS-10-002-apache-isapi.mp4

Solution.
Upgrade to the latest version of Apache HTTP Server (currently
2.2.15).

Discovered by.
Brett Gervasoni from Sense of Security Labs.

About us.

Sense of Security is a leading provider of information security and risk
management

solutions. Our team has expert skills in assessment and assurance, strategy
and

architecture, and deployment through to ongoing management. We are Australia's

premier application penetration testing firm and trusted IT security advisor
to many of

the countries largest organisations.

Sense of Security Pty Ltd

Level 3, 66 King St

Sydney NSW 2000

AUSTRALIA

T: +61 (0)2 9290 4444

F: +61 (0)2 9290 4455

W: http://www.senseofsecurity.com.au/consulting/penetration-testing

E: info@senseofsecurity.com.au

Twitter: ITsecurityAU

The latest version of this advisory can be found at:

http://www.senseofsecurity.com.au/advisories/SOS-10-002


Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close