Apache Week issue 299

Apache Week <[email protected]> Wed, 19 Jun 2002 15:05:16 +0100

Newsgroups	gmane.comp.apache.apacheweek
Message-ID	<[email protected]>

APACHE WEEK

The essential weekly guide for users of the world's most popular Web server.
Issue 299: 21st June 2002

In this issue

* Security Reports
* Apache 1.3.26 Released
* Apache 2.0.39 Released

Security Reports

This weeks issue of Apache Week has been released early due to an
important Apache security issue

Chunked encoding vulnerability

A security vulnerability has been found in the Apache Web server
that affects all versions of Apache 1.2 since Apache 1.2.2, all
versions of Apache 1.3 prior to Apache 1.3.26, and versions of
Apache 2.0 prior to Apache 2.0.39. The severity of the
vulnerability varies across different versions of Apache and which
platform is used; extending from a relatively harmless increase in
system resources through to denial of service attacks. In some
cases a remote exploit may be possible. The Apache Software
Foundation has released an [1]Official Security Advisory which can
also be found (PGP signed) at [2]BugTraq. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name [3]CAN-2002-0392 to this issue.

Our summary of the issue:
* If you are using Apache 1.3 on 32-bit Unix platforms then the
effects of this vulnerability are minor. A remote attacker can
cause the child process that is processing their request to die.
The Apache parent process will eventually get around to replacing
the child when required.
* If you are using Apache 1.3 on 64-bit Unix platforms then the
effects depend on the platform. It may be possible on some 64-bit
platforms for a remote attacker to remotely exploit the
vulnerability and run arbitrary commands as the Apache user.
* Apache 1.3 on Windows is remotely exploitable. An attacker can
remotely exploit the vulnerability and run arbitrary commands on
the server
* Apache 2.0 is not remotely exploitable, but the effects can range
from the minimal child replacement to more severe denial of
service attacks depending on the platform and process model in use

All users of Apache are advised to upgrade to either Apache 1.3.26
or Apache 2.0.39 available from [4]httpd.apache.org

In the News

The security issue got a fair amount of media coverage, with Apache
Week's own Mark Cox providing a number of quotes (some of which
were reported accurately too!). Rather than give yet another
version of events here in Apache Week if you are interested in how
the flaw was found and the controversy over the reporting of the
issues see our favourite write-up, [5]"Apache admins screwed by
premature vuln report" by Thomas C Greene at The Register.

We also found the following articles:
* [6]"CERT Advisory CA-2002-17 Apache Web Server Chunk Handling
Vulnerability"
* [7]"The Apache vulnerability, full disclosure, and monocultures"
at LWN.net
* [8]"Apache Web Server Security Alert and ISS" by Eric Lubow at
LinuxSecurity.com
* [9]"Miscommunication after flaw found in Apache server software"
by D. Ian Hopper at The Nando Times and at [10]WashingtonPost.com
* [11]"Two security alerts point to Apache Web Server flaws" by Todd
R. Weiss at ComputerWorld
* [12]"Apache Chunk Handling Bug Detected" by Ryan Naraine at
InternetNews.com
* [13]"Experts warn of major hole in Apache Web server" by Joris
Evers at InfoWorld
* [14]"Apache hole is an open door to hackers" at Silicon.com
* [15]"Security alerts highlight Apache Web Server flaws" at
ComputerWeekly CW360
* [16]"Apache hole puts millions at risk" by Robert Jaques at
vnunet.com
* [17]"Security warning too quick for comfort?" by Robert Lemos at
CNET News.com and at [18]ZD Net Tech News
* [19]"Apache Vulnerability Announced" at Slashdot.org
* [20]"Remote Compromise Vulnerability in Apache HTTP Server" as
reported by [21]ISS X-Force at BugTraq
* [22]ISS X-Force response at BugTraq

Apache 1.3.26 Released

Apache 1.3.26 was released on 18th June 2002 and is now the latest
version of the Apache 1.3 server. The previous release was 1.3.24,
released on the 22nd March 2002. [23]See what was new in Apache
1.3.24. Apache 1.3.25 was never released.

Apache 1.3.26 is available in source form for compiling on Unix or
Windows, for download from the [24]main Apache site or from any
[25]mirror download site.

This is a security, bug fix and minor upgrade release. Due to
security issues, any sites using versions prior to Apache 1.3.26
should upgrade to Apache 1.3.26. [26]Read more about the other
security issues that affect Apache 1.3.

Security issues

* Fix the chunked encoding security vulnerability.
([27]CAN-2002-0392)

New features

The main new features in 1.3.26 (compared to 1.3.24) are:
* Add text/xml, application/xhtml+xml, audio/mpeg, and
video/quicktime mime types to the mime types magic file.
[28]PR#7730
* Added a -F flag which causes the supervisor process to no longer
fork down and detach and instead stay attached to the tty. This
allows integration with daemontools. [29]PR#7628

Bugs fixed

The following bugs were found in Apache 1.3.24 and have been fixed
in Apache 1.3.26:
* Allow child processes sufficient time for cleanups but making
ap_select in reclaim_child_processes more "resistant" to signal
interrupts. [30]BZ#8176
* In Darwin, place dynamically loaded Apache extensions' public
symbols into the global symbol table. This allows dynamically
loaded PHP extensions.
* Fix for a problem in mod_rewrite which would lead to 400 Bad
Request responses for rewriting rules which resulted in a local
path. Note: This will also reject invalid requests as issued by
Netscape-4.x Roaming Profiles (on a DAV-enabled server)
* Recognize platform-specific root directories (other than leading
slash) in mod_rewrite for filename rewrite rules. [31]BZ#7492
* Disallow anything but whitespace on the request line after the
HTTP/x.y protocol string to prevent arbitrary user input from
ending up in the access_log and error_log. Also control characters
are now escaped.
* A large number of fixes in mod_proxy including: adding support for
dechunking chunked responses, correcting a timeout problem which
would force long or slow POST requests to close after 300 seconds
[32]PR#7552, adding "X-Forwarded" headers, dealing correctly with
the multiple-cookie header bug, ability to handle unexpected
100-continue responses sent during PUT or POST commands, and a
change to tighten up the Server header overwrite bug-fix.

Apache 2.0.39 Released

Apache 2.0.39 was released on 18th June 2002 and is now the latest
version of the Apache server. This is the third stable release of
Apache 2.0, following up on 2.0.36 which was released on 8th May
2002. Read our [33]special feature for more information about the
history of Apache 2.0.

Apache 2.0.39 is available in source form for compiling on Unix or
Windows, for download from the [34]main Apache site or from any
[35]mirror download site.

This is a security, bug fix and minor upgrade release. Due to
security issues, any sites using versions of Apache 2 prior to
Apache 2.0.39 should upgrade to Apache 2.0.39.

Security issues

* Fix the chunked encoding security vulnerability.
([36]CAN-2002-0392)

New features

The new features in this release (added since 2.0.36) are:
* Integration of apachectl functionality into httpd using the -k
start|restart|graceful|stop option.
* mod_ssl now respects the standard logging directives; the SSLLog
and SSLLogLevel directives have been deprecated.

Bug Fixes

The bugs fixed in this release include:
* Semaphore permission handling problems which meant that on some
platforms, mod_ssl would stop serving requests after a period of
time. [37]BZ#8124 (The bug also affects mod_rewrite if
RewriteLogLevel is set above 0).
* Use of random maps with mod_rewrite is now fixed ([38]BZ#9770).
* Ignore errors from mutexes (using certain mutex types) during a
graceful restart, in the prefork MPM.
* Fix handling of nested if statements in mod_include ([39]BZ#9866)
* The +OptRenegotiate option has been fixed in mod_ssl
* SSL CONNECT tunnelling has been fixed in mod_proxy ([40]BZ#8903)
* Using mod_userdir together with ScriptAlias to enable CGI in home
directories is fixed ([41]BZ#8841)
* mod_deflate changes: fix for corrupted output [42]BZ#9014, and not
compressing already-compressed content [43]BZ#9222
* apxs changes: fix warnings from unknown -q options ([44]BZ#9316),
use correct directory locations ([45]BZ#8869, [46]BZ#8453, and
more ([47]BZ#9316)

Platform-specific changes

The following platform-specific changes have been made:
* fix 'make install' on ReliantUnix
* for Win32: fix ServerRoot handling on Win32, and many improvements
to the mod_isapi module
* fix to not open a window for CGI programs on Win32/Netware
* fix corruption of binary files when using CygWin ([48]BZ#9185)
* an unserialized accept() can be used in AIX 4.3.2 and above
______________________________________________________________

This issue brought to you by: Mark J Cox, Joe Orton, Min Min Tsan
Comments or criticisms? Please email us at
[49][email protected].

References

1. http://httpd.apache.org/info/security_bulletin_20020617.txt
2. http://marc.theaimsgroup.com/?l=bugtraq&m=102433551031241
3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392
4. http://httpd.apache.org/
5. http://theregister.co.uk/content/4/25766.html
6. http://www.cert.org/advisories/CA-2002-17.html
7. http://lwn.net/Articles/2756/
8. http://www.linuxsecurity.com/articles/server_security_article-5157.html
9. http://www.nandotimes.com/technology/story/437951p-3506299c.html
10. http://www.washingtonpost.com/wp-dyn/articles/A3096-2002Jun18.html
11. http://www.computerworld.com/securitytopics/security/story/0,10801,72074,00.html
12. http://www.internetnews.com/dev-news/article.php/10792_1367401
13. http://www.infoworld.com/articles/hn/xml/02/06/17/020617hnapache.xml
14. http://www.silicon.com/public/door?REQUNIQ=1024407823&6004REQEVENT=&REQINT1=53998&REQSTR1=newsnow
15. http://c.moreover.com/click/here.pl?r40654722
16. http://www.vnunet.com/News/1132708
17. http://news.com.com/2100-1001-936924.html
18. http://zdnet.com.com/2100-1105-936949.html
19. http://slashdot.org/article.pl?sid=02/06/17/1948249
20. http://online.securityfocus.com/archive/1/277249
21. http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20502
22. http://online.securityfocus.com/archive/1/277326
23. http://www.apacheweek.com/issues/02-03-29#apache1324
24. http://www.apache.org/dist/httpd/
25. http://www.apache.org/mirrors/
26. http://www.apacheweek.com/features/security-13
27. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392
28. http://bugs.apache.org/index/full/7730
29. http://bugs.apache.org/index/full/7628
30. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8176
31. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=7492
32. http://bugs.apache.org/index/full/7552
33. http://www.apacheweek.com/features/ap2
34. http://www.apache.org/dist/httpd/
35. http://www.apache.org/mirrors/
36. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392
37. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8124
38. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9770
39. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9866
40. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8903
41. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8841
42. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9014
43. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9222
44. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9316
45. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8869
46. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=8453
47. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9316
48. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=9185
49. mailto:[email protected]
50. http://www.apacheweek.com/
51. http://www.redhat.com/

----------------------------------------------------------------------
To unsubscribe: https://listman.redhat.com/mailman/listinfo/apacheweek
or send the message "unsubscribe" to [email protected]
----------------------------------------------------------------------