Re: Apache Vulnerability in WebTen

On Monday 24 June 2002 04:41 pm, you wrote:
> THat may be true for user "nobody" but it has nothing to do with the apache
> problem. re-read the cert - assumption of root is usually the object of
> most such hack attempts, for your future reference. What do you think
> arbitrary code is ?

Read below:

Red Hat Network has determined that the following advisory is applicable to
one or more of the systems you have registered:


Complete information about this errata can be found at the following location:
     https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1100


Security Advisory - RHSA-2002:103-13
------------------------------------------------------------------------------
Summary:
Updated Apache packages fix chunked encoding issue


The Apache Web server contains a security vulnerability which can be used
to launch a denial of service attack, or in some cases, allow remote code
execution.


Description:
Versions of the Apache Web server up to and including 1.3.24 contain a bug
in the routines which deal with requests encoded using "chunked" encoding.
A carefully crafted invalid request can cause an Apache child process to
call the memcpy() function in a way that will write past the end of its
buffer, corrupting the stack.


The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0392 to this issue.


Our investigations show that this bug cannot be used to gain remote access
to a server running Apache on Red Hat Linux on 32-bit platforms, but it
does cause the child process to die. The Apache parent process will
notice this and start a new child process when necessary -- using more
resources than normal.


Investigations by the Apache Software Foundation show that in some cases
64-bit platforms may have a greater exposure and could be remotely
exploited to allow arbitrary code to be run on the server.


We have backported the security fix from the official Apache 1.3.26
release. This should help minimize the impact of upgrading to our errata
packages.


All users of Apache should update to these errata packages to correct this
security issue.


References:
http://httpd.apache.org/info/security_bulletin_20020617.txt
http://www.apacheweek.com/issues/02-06-21

I'm not sure about webten, but I know of know ordinary user account on any 
other *nix which could instigate a DoS attack.

-- 
 Robert Brandtjen
 --------------------------------------
 Web Site Creation and Hosting Services
 Hostmaster@xxxxxxxxxxxxxxxxxxx
 www.prometheusmedia.com