Apache Chunked Encoding Memory Corruption exploit signature

Greetings,

On June 17, 2002, a vulnerability, the Apache Chunked Encoding Memory
Corruption vulnerability (Bugtraq ID 5033), was reported in the Apache Web
server.  Versions 1.3.x and 2.0.x are vulnerable. In response, the Apache
Software Foundation has released versions 1.3.26 and 2.0.39, which include
a patch for this vulnerability. On June 19, 2002, an exploit was released
for this vulnerability, targeting Apache on OpenBSD operating systems.
Claims were also made that exploits exist for other Unix operating
systems.

The following exploit specific Snort signature has been created for the
Apache Chunked Encoding Memory Corruption exploit, apache-scalp.c, which
is available at http://online.securityfocus.com/bid/5033/exploit/ :

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 \
(msg:"Apache Chunked Encoding Memory Corruption exploit attempt"; \
flags:A+; content:"|C0 50 52 89 E1 50 51 52 50 B8 3B 00 00 00 CD 80|"; \
reference:bugtraq,5033; classtype:web-application-activity; rev:1;)

Although this exploit requires a chunked encoding transfer in order to
function, due to the irregular method of reassembling TCP streams, the
addition of chunked encoding related headers to the above Snort signature
would cause the signature to fail in the event of improperly reassembled
TCP streams. This is due to the length of the exploit and the fact that
the shellcode sequence occurs well before the "chunked encoding" string
within the payload.

The above signature translates to xC0 followed by the following x86
instructions:

0x50                         push    eax
0x52                         push    edx
0x89 0xE1                    mov     ecx, esp
0x50                         push    eax
0x51                         push    ecx
0x52                         push    edx
0x50                         push    eax
0xB8 0x3B 0x00 0x00 0x00     mov     eax, 59 (OpenBSD sys_execve)
0xCD 0x80                    int     80h

Additionally, the chunked encoding signature

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 \
(msg:"Possible Chunked Encoding transfer attempt"; flags:A+; \
content:"Transfer-Encoding|3A|"; nocase; content:"chunked"; nocase; \
reference:bugtraq,4485; classtype:web-application-activity; rev:3;)

which is available in the MS02-18 Snort rules file at:

http://analyzer.securityfocus.com/rules/IISSigs.rules

will catch this exploit; however, it is prone to false positives. Also,
please note that this Chunked Encoding signature will detect attempts at
the Microsoft IIS Chunked Encoding Transfer Heap Overflow Vulnerability
without incurring the false negative condition associated with some other
signatures.

We recommend that administrators add these rules to their Snort IDS, or
configure their IDS with signatures for these issues.

If you have any questions or comments, feel free to contact us at
[email protected].

Cheers,

Mario van Velzen, [email protected]
DeepSight Threat Analyst Manager