-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SGI Security Advisory Title: Apache Web Server Chunk Handling vulnerability Number: 20020605-01-I Date: July 12, 2002 Reference: SGI Security Advisory 20020605-01-A Reference: CERT CA-2002-17 Reference: Apache Security Bulletin 20020617 Reference: CAN-2002-0392 ______________________________________________________________________________ - ----------------------- - --- Issue Specifics --- - ----------------------- This bulletin is an update to SGI Security Advisory 20020605-01-A. It has been reported that versions of the Apache web server up to and including 1.3.24 and 2.0 up to and including 2.0.36 contain a bug in the routines which deal with invalid requests which are encoded using chunked encoding. This bug can be triggered remotely by sending a carefully crafted invalid request. This functionality is enabled by default. See http://httpd.apache.org/info/security_bulletin_20020617.txt for additional details. SGI has investigated the issues and recommends the following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be implemented on ALL vulnerable SGI systems. These issues have been corrected in IRIX 6.5.17, where we are now supplying a fixed version of Apache. We are also making the fixed version of Apache available on our security FTP site for prior releases of IRIX. - -------------- - --- Impact --- - -------------- The Apache webserver is supplied with IRIX versions since 6.5.12m/f as a replacement for the older SGI FastTrack server. It is installed by default, and is enabled through "chkconfig" by default. In order to determine if the Apache webserver is installed, execute the following command: # versions -b | grep apache If the following line is returned you are OK: I sgi_apache 07/10/2002 SGI Web Server based on Apache, 1.3.26 But if either of these are returned you are vulnerable: I sgi_apache 03/20/2001 SGI Apache Server, 1.3.17 I sgi_apache 06/10/2001 SGI Apache Server, 1.3.20 I sgi_apache 12/06/2001 SGI Web Server based on Apache, 1.3.22 These vulnerabilities might lead to a root compromise in some configurations, and no local account is required. These vulnerabilities have been publicly discussed in Usenet newsgroups and mailing lists. This vulnerability was assigned the following CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392 - ---------------------------- - --- Temporary Workaround --- - ---------------------------- SGI acknowledges that it may not always be possible to immediately install patches or upgrade the operating system. In those cases, we recommend removing the Apache webserver and associated products by using the following commands: # versions remove sgi_apache\* # versions remove websetup\* # versions remove gateway\* It is not necessary to reboot the system after doing this. You should upgrade the operating system as soon as it is possible to do so. - ---------------- - --- Solution --- - ---------------- SGI has not provided a patch for these issues, but instead has rolled the fixed Apache distribution into IRIX 6.5.17 and later releases of the operating system. OS Version Vulnerable? Patch # Other Actions ---------- ----------- ------- ------------- IRIX 3.x no Note 1 IRIX 4.x no Note 1 IRIX 5.x no Note 1 IRIX 6.0.x no Note 1 IRIX 6.1 no Note 1 IRIX 6.2 no Note 1 IRIX 6.3 no Note 1 IRIX 6.4 no Note 1 IRIX 6.5 no Note 2 IRIX 6.5.1 no Note 2 IRIX 6.5.2 no Note 2 IRIX 6.5.3 no Note 2 IRIX 6.5.4 no Note 2 IRIX 6.5.5 no Note 2 IRIX 6.5.6 no Note 2 IRIX 6.5.7 no Note 2 IRIX 6.5.8 no Note 2 IRIX 6.5.9 no Note 2 IRIX 6.5.10 no Note 2 IRIX 6.5.11 no Note 2 IRIX 6.5.12 yes Note 2 IRIX 6.5.13 yes sgi_apache 1.3.26 Note 2 & 3 IRIX 6.5.14 yes sgi_apache 1.3.26 Note 2 & 3 IRIX 6.5.15 yes sgi_apache 1.3.26 Note 2 & 3 IRIX 6.5.16 yes sgi_apache 1.3.26 Note 2 & 3 IRIX 6.5.17 no NOTES 1) This version of the IRIX operating has been retired. Upgrade to an actively supported IRIX operating system. See http://support.sgi.com/irix/news/index.html#policy for more information. 2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact your SGI Support Provider or URL: http://support.sgi.com/irix/swupdates/ 3) Install sgi_apache 1.3.26 which is supplied with the IRIX 6.5.17 Applications CD or available as sgi_apache-1.3.26.tar from: ftp://patches.sgi.com/support/free/security/patches/{6.5.13-6.5.16} ##### Patch File Checksums #### The actual patch will be a tar file containing the following files: Filename: sgi_apache Algorithm #1 (sum -r): 24080 5 sgi_apache Algorithm #2 (sum): 37968 5 sgi_apache MD5 checksum: 1EE81B8F7A8DF9ED4D9AF507EA1D2755 Filename: sgi_apache.books Algorithm #1 (sum -r): 65292 3274 sgi_apache.books Algorithm #2 (sum): 32822 3274 sgi_apache.books MD5 checksum: CD6296A58A1B6F1FF2D6B212058D1C4D Filename: sgi_apache.idb Algorithm #1 (sum -r): 13477 281 sgi_apache.idb Algorithm #2 (sum): 4276 281 sgi_apache.idb MD5 checksum: 3144B64008FF66BF858434208C6BCB5B Filename: sgi_apache.man Algorithm #1 (sum -r): 29483 97 sgi_apache.man Algorithm #2 (sum): 35420 97 sgi_apache.man MD5 checksum: A7864555852DB7ACC913F049BFC46121 Filename: sgi_apache.src Algorithm #1 (sum -r): 43010 6244 sgi_apache.src Algorithm #2 (sum): 58317 6244 sgi_apache.src MD5 checksum: 7D2A6A9A226327D8D9990F80635AED80 Filename: sgi_apache.sw Algorithm #1 (sum -r): 20406 1852 sgi_apache.sw Algorithm #2 (sum): 32509 1852 sgi_apache.sw MD5 checksum: 371625EE5B321A76137AD1A18B23B4C0 - ------------------- - --- Information --- - ------------------- SGI Security Advisories can be found at: http://www.sgi.com/support/security/ and ftp://patches.sgi.com/support/free/security/advisories/ SGI Security Patches can be found at: http://www.sgi.com/support/security/ and ftp://patches.sgi.com/support/free/security/patches/ SGI patches for IRIX can be found at the following patch servers: http://support.sgi.com/irix/ and ftp://patches.sgi.com/ SGI freeware updates for IRIX can be found at: http://freeware.sgi.com/ SGI fixes for SGI open sourced code can be found on: http://oss.sgi.com/projects/ SGI patches and RPMs for Linux can be found at: http://support.sgi.com/linux/ or http://oss.sgi.com/projects/sgilinux-combined/download/security-fixes/ SGI patches for Windows NT or 2000 can be found at: http://support.sgi.com/nt/ IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at: http://support.sgi.com/irix/ and ftp://patches.sgi.com/support/patchset/ IRIX 6.5 Maintenance Release Streams can be found at: http://support.sgi.com/colls/patches/tools/relstream/index.html IRIX 6.5 Software Update CDs can be obtained from: http://support.sgi.com/irix/swupdates/ The primary SGI anonymous FTP site for security advisories and patches is patches.sgi.com (216.32.174.211). Security advisories and patches are located under the URL ftp://patches.sgi.com/support/free/security/ For security and patch management reasons, ftp.sgi.com (mirrors patches.sgi.com security FTP repository) lags behind and does not do a real-time update. - ------------------------ - --- Acknowledgments ---- - ------------------------ SGI wishes to thank Mark Litchfield, CERT, ISS and the users of the Internet Community at large for their assistance in this matter. - ----------------------------------------- - --- SGI Security Information/Contacts --- - ----------------------------------------- If there are questions about this document, email can be sent to security-info@sgi.com. ------oOo------ SGI provides security information and patches for use by the entire SGI community. This information is freely available to any person needing the information and is available via anonymous FTP and the Web. The primary SGI anonymous FTP site for security advisories and patches is patches.sgi.com (216.32.174.211). Security advisories and patches are located under the URL ftp://patches.sgi.com/support/free/security/ The SGI Security Headquarters Web page is accessible at the URL: http://www.sgi.com/support/security/ For issues with the patches on the FTP sites, email can be sent to security-info@sgi.com. For assistance obtaining or working with security patches, please contact your SGI support provider. ------oOo------ SGI provides a free security mailing list service called wiretap and encourages interested parties to self-subscribe to receive (via email) all SGI Security Advisories when they are released. Subscribing to the mailing list can be done via the Web (http://www.sgi.com/support/security/wiretap.html) or by sending email to SGI as outlined below. % mail wiretap-request@sgi.com subscribe wiretap end ^d In the example above, is the email address that you wish the mailing list information sent to. The word end must be on a separate line to indicate the end of the body of the message. The control-d (^d) is used to indicate to the mail program that you are finished composing the mail message. ------oOo------ SGI provides a comprehensive customer World Wide Web site. This site is located at http://www.sgi.com/support/security/ . ------oOo------ If there are general security questions on SGI systems, email can be sent to security-info@sgi.com. For reporting *NEW* SGI security issues, email can be sent to security-alert@sgi.com or contact your SGI support provider. A support contract is not required for submitting a security report. ______________________________________________________________________________ This information is provided freely to all interested parties and may be redistributed provided that it is not altered in any way, SGI is appropriately credited and the document retains and includes its valid PGP signature. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBPS+/UrQ4cFApAP75AQHVJgQApjJG7ZUFT3S/wE7p1khZUiSxBpo1r0qc inVeNOm1LskJAcr12rVpoKxAvl5UQA1AxeBuDJj1Om5DDN4jHI7mHbTGey4ZdFpJ 6TaewGXadi5xIW75Xh5dFnGYtmRCRSpekSt6VJzVmeYYocmkZyZ/VUjjDo2187Cv o2LTSqrYsow= =1pxh -----END PGP SIGNATURE-----