RE: Apache HTTP Server Chunk Encoding Vulnerab ility

The problem with apply patches by hand is that at least one function is
named different:

notice how in the official patch, ap_isxdigit is used while in older
versions, isxdigit is used.

This diff is from an updated http_protocol.c  from Stronghold 2.4.

I hope this helps.

1411a1412,1417
> 	if (r->remaining < 0) {
> 		ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, r,
> 		 "Request content-length of %s maps to negative number %ld",
> 		 lenp, r->remaining);
> 		return HTTP_BAD_REQUEST;
> 	}
1444a1451
>     long chunkbits = sizeof(long) * 8;
1446c1453,1458
<     while (isxdigit(*b)) {
---
>     /* Skip leading zeros */
>     while (*b == '0') {
> 	++b;
>     }
> 
>     while (isxdigit(*b) && (chunkbits > 0)) {
1449c1461
<         if (*b >= '0' && *b <= '9')
---
>         if (*b >= '0' && *b <= '9') {
1451c1463,1464
<         else if (*b >= 'A' && *b <= 'F')
---
> 	}
>         else if (*b >= 'A' && *b <= 'F') {
1453c1466,1467
<         else if (*b >= 'a' && *b <= 'f')
---
> 	}
>         else if (*b >= 'a' && *b <= 'f') {
1454a1469
> 	}
1456a1472
> 	chunkbits -= 4;
1459a1476,1480
>     if (isxdigit(*b) && (chunkbits <= 0)) {
> 	/* overflow */
> 	return -1;
>     }
> 
1526a1548,1551
> 	else if (len_to_read < 0) {
> 	    r->connection->keepalive = -1;
> 	    return -1;
> 	}

Thanks,

Jon Horner, CISSP
SAIC WebPool
[email protected]
Office:  (865) 425-5178
Pager:  (865) 417-5012


> -----Original Message-----
> From: marcus [mailto:[email protected]]
> Sent: Thursday, June 20, 2002 3:52 PM
> To: [email protected]
> Subject: Re: [Stronghold-users] Apache HTTP Server Chunk Encoding
> Vulnerability
> 
> 
> Raynard,
> 
> All versions of the Apache web server up to and
> including 1.3.24 are affected. Check out the official
> Apache advisory at: 
> 
> http://httpd.apache.org/info/security_bulletin_20020617.txt
> 
> to see it for yourself.
> 
> Get the Red Hat patch for Stronghold 3.0 from:
> 
> http://stronghold.redhat.com/sh3/errata-2002-118
> 
> and apply the patch to Stronghold 2.4.2 by hand
> yourself. I guess that's the only way since Stronghold
> 2.4.2 is no longer supported. Else upgrade to the
> latest version of Stronghold.
> 
> Marcus
> 
>  --- "Raynard A. Jong" <[email protected]> wrote: 
> > Are older versions of Stronghold also affected by
> > the Apache 
> > vulnerability recently announced by CIAC?
> > 
> > PROBLEM:       The Apache HTTP Server has a software
> > flaw that misinterprets
> >                 invalid requests encoded using
> > chunked encoding. This error can
> >                 be triggered remotely by sending
> > certain invalid requests.
> > PLATFORM:      Any systems running Apache web server
> > 1.3.24 and 2.0 up to and
> >                 including 2.0.36.
> > DAMAGE:        Successful exploitation may lead to
> > modified Web content,
> >                 denial of service, or further
> > compromise.
> > SOLUTION:      Users of Apache 1.3 should upgrade to
> > 1.3.26, and users of
> >                 Apache 2.0 should upgrade to 2.0.39,
> > which contains a fix for
> >                 this issue.
> > 
> > 
> > In particular, is the older version, Stronghold
> > 2.4.2 which is built 
> > on Apache 1.3.6  vulnerable?  I notice that Apache
> > 1.3.6 is earlier 
> > than the versions of Apache cited in the CIAC
> > bulletin.  So perhaps 
> > the older software is safe from the problem?
> > 
> > If Stronghold  2.4.2 is a problem, what fixes, if
> > any are available?
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Everything you'll ever need on one web page
> from News and Sport to Email and Music Charts
> http://uk.my.yahoo.com
> 
> 
> 
> _______________________________________________
> Stronghold-users mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/stronghold-users
>