|
|
|
|
| |
Mod_SSL provides strong cryptography for the Apache 1.3 webserver via the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols by the help of the Open Source SSL/TLS toolkit OpenSSL, which is based on SSLeay from Eric A. Young and Tim J. Hudson.
The mod_ssl package was created in April 1998 by Ralf S. Engelschall and was originally derived from software developed by Ben Laurie for use in the Apache-SSL HTTP server project. The mod_ssl package is licensed under a BSD-style license, which means that you are free to get and use it for commercial and non-commercial purposes.
A security vulnerability in the product allows attackers to overwrite one byte after the provided data space, causing the execution of arbitrary code. |
| |
Credit:
The information has been provided by Jedi/Sector One.
|
| |
Vulnerable systems:
* mod_ssl version 2.8.9 and earlier
Immune systems:
* mod_ssl version 2.8.10
The Apache web server provides an extended API (EAPI) to easily extend the server with third-party modules, through various hooks called as needed. One of these hooks, rewrite_command, is called right after a configuration directive line was read and before it is processed.
Mod_ssl registers such a rewrite_command hook when backward compatibility is enabled. The ssl_compat_directive() is called for every line read in a configuration file.
However, this function contains an off-by-one error in this code snippet:
...
char *cp;
char caCmd[1024];
char *cpArgs;
...
cp = (char *)oline;
for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < 1024; )
^^^^^^^^
caCmd[i++] = *cp++;
caCmd[i] = NUL;
cpArgs = cp;
...
Oline is a pointer to a line being parsed, and whose content can be arbitrary long, and controlled by untrusted users through ".htaccess" files.
Impact:
Apart from global configuration files, Apache allows per-directory configuration files. Therefore, the bug can be triggered by any regular user through specially crafted ".htaccess" files.
The stack can be smashed. Alexander Yurchenko wrote a proof of concept exploit for OpenBSD to demonstrate that arbitrary code could be executed through ".htaccess" files.
As noticed by Michal Zalewski, you can cause an overflow in every child running to force all of them do what you want. This is much more dangerous than children forked for CGI execution.
Possible implications include denial of service (by sending STOP signals to every child), adding fake entries to every log file (not only those from the virtualhost the .htaccess lies in), running arbitrary commands as the web server user regardless of ExecCGI and suexec settings and spoofing replies.
Workaround:
Disallow per-directory configuration files by only having "AllowOverride None" directives in your httpd.conf file, and restart the web server.
Fixes:
The mod_ssl development team was very reactive and a new version has just been released. mod_ssl 2.8.10 addresses the vulnerability and it is freely available from http://www.modssl.org/. Upgrading from an earlier release is painless.
The bug has also been fixed in OpenBSD-current, thanks to fgsch.
The following oneliner patch also addresses the problem:
--- pkg.sslmod/ssl_engine_compat.c.orig Sat Feb 23 19:45:23 2002
+++ pkg.sslmod/ssl_engine_compat.c Mon Jun 24 20:43:17 2002
@@ -309,7 +309,7 @@
* Extract directive name
*/
cp = (char *)oline;
- for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < 1024; )
+ for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < sizeof(caCmd) - 1; )
caCmd[i++] = *cp++;
caCmd[i] = NUL;
cpArgs = cp;
|
|
|
|
|
|
|
