-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 05.30.03: http://www.idefense.com/advisory/05.30.03.txt Apache Portable Runtime Denial of Service and Arbitrary Code Execution Vulnerability April 30, 2003 I. BACKGROUND The Apache Software Foundation's HTTP Server Project is an effort to develop and maintain an open-source web server for modern OS' including Unix and Microsoft Corp.'s Windows. More information is available at http://httpd.apache.org/ . The Apache Portable Runtime (APR) provides a free library of C data structures and routines, forming a system portability layer to as many OS' as possible. More information is available at http://apr.apache.org/ . mod_dav is an open-source Apache module that provides Distributed Authoring and Versioning (DAV) capabilities to the Apache HTTP Server. More information is available at http://www.webdav.org/mod_dav/ . II. DESCRIPTION Passing an overly long string to the apr_psprintf() APR library function that is used by the Apache HTTP Server could cause an application to reference memory that should have already been returned to the heap allocation pool. Arbitrary code execution remains a possibility but has not been substantiated at the time of publication of this report. Considering the strict conditions necessary for successful code execution, it would be feasible but difficult to develop an exploit capable of functioning outside of a lab environment. III. ANALYSIS The remote denial of service aspect of this vulnerability can be exploited if a remote attacker is able to pass large strings to the vulnerable function, as is the case in the mod_dav attack vector, where a specially crafted XML object request of approximately 12250 bytes crashed HTTP Server running on a non-Windows OS; approximately 20000 characters crashed it on a Windows OS. IV. DETECTION Applications that rely on older versions of APR are vulnerable. A list of such projects is available at http://apr.apache.org/projects.html#open_source . Both the Windows and Unix implementations of Apache HTTP Server 2.0.37 through 2.0.45 inclusive are vulnerable. V. WORKAROUND The following patch should mitigate this vulnerability: - - --- srclib/apr/memory/unix/apr_pools.c 7 Mar 2003 12:12:43 -0000 1.195 +++ srclib/apr/memory/unix/apr_pools.c 8 May 2003 20:11:14 -0000 @@ -976,7 +976,7 @@ if (ps->got_a_new_node) { active->next = ps->free; - - - ps->free = node; + ps->free = active; } ps->got_a_new_node = 1; VI. VENDOR FIX Apache HTTP Server 2.0.46, which contains updates for APR, can be downloaded at http://httpd.apache.org/download.cgi . VII. CVE INFORMATION The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project has assigned the identification number CAN-2003-0245 to this issue. VIII. DISCLOSURE TIMELINE 03/19/2003 Issue disclosed to iDEFENSE 04/08/2003 iDEFENSE Labs initial research complete 04/09/2003 security@apache.org contacted 04/09/2003 Response from Lars Eilebrecht and Bill Rowe of Apache 04/11/2003 Response from Ian Holsman of Apache 05/08/2003 Response from Mark Cox of Apache 05/08/2003 Initial Research and patch Submitted to iDEFENSE by Joe Orton of Apache 05/09/2003 Apache patch verified by iDEFENSE Labs 05/12/2003 vendor-sec list notified 05/26/2003 iDEFENSE clients notified 05/30/2003 Coordinated Public Disclosure Get paid for security research http://www.idefense.com/contributor.html Subscribe to iDEFENSE Advisories: send email to listserv@idefense.com, subject line: "subscribe" About iDEFENSE: iDEFENSE is a global security intelligence company that proactively monitors sources throughout the world — from technical vulnerabilities and hacker profiling to the global spread of viruses and other malicious code. Our security intelligence services provide decision-makers, frontline security professionals and network administrators with timely access to actionable intelligence and decision support on cyber-related threats. For more information, visit http://www.idefense.com . -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPte/IPrkky7kqW5PEQKrCwCg1fwptDn+mt0feP0n6rpdUdnMtQIAoNlE wry6xtyvKO3hS4trsrOnh/Dp =PKD4 -----END PGP SIGNATURE----- To stop receiving iDEFENSE Security Advisories, reply to this message and put "unsubscribe" in the subject.