AusCERT - ESB-2006.0751 -- [Solaris] -- Security Vulnerabilities in the Apache 2.0 Web Server "mod_rewrite", "mod_imap" and "mod

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2006.0751 -- [Solaris] -- Security Vulnerabilities in the Apache 2.0 Web Server "mod_rewrite", "mod_imap" and "mod_ssl" Modules
Date: 06 March 2007
References: AL-2006.0061

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                        ESB-2006.0751 -- [Solaris]
           Security Vulnerabilities in the Apache 2.0 Web Server
              "mod_rewrite", "mod_imap" and "mod_ssl" Modules
                              12 October 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Apache 2.0
Publisher:            Sun Microsystems
Operating System:     Solaris
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
                      Cross-site Scripting
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-3747 CVE-2005-3357 CVE-2005-3352

Ref:                  AL-2006.0061

Original Bulletin:    http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102662-1

Revision History:     March    7 2007: Workaround added for mod_rewrite issue
                      October 12 2006: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Sun(sm) Alert Notification
     * Sun Alert ID: 102662
     * Synopsis: Security Vulnerabilities in the Apache 2.0 Web Server
       "mod_rewrite", "mod_imap" and "mod_ssl" Modules
     * Category: Security
     * Product: Solaris 10 Operating System
     * BugIDs: 6452767, 6423037, 6423033
     * Avoidance: Patch, Workaround
     * State: Resolved
     * Date Released: 10-Oct-2006
     * Date Closed: 10-Oct-2006
     * Date Modified: 01-Mar-2007

1. Impact

   Three security vulnerabilities have been found in the Apache HTTP
   server which affect the Apache 2.0 web server bundled with Solaris 10.

   The first issue, a vulnerability in the mod_rewrite Apache HTTP server
   module (CVE-2006-3747), may allow a local or remote unprivileged user
   to execute arbitrary code with the privileges of the Apache 2.0
   process or cause a Denial of Service (DoS) to the Apache HTTP process.
   The Apache 2.0 HTTP process normally runs as the unprivileged user
   "webservd" (uid 80).

   The second issue, a vulnerability in the mod_ssl Apache HTTP server
   module (CVE-2005-3357), may allow a local or remote unprivileged user
   to cause a Denial of Service (DoS) to the Apache HTTP process.

   The third issue, a Cross Site Scripting (CSS or XSS) vulnerability in
   the mod_imap Apache HTTP server module (CVE-2005-3352), may allow a
   local or remote unprivileged user to steal cookie information, hijack
   sessions, or cause a loss of data privacy between a client and the
   server.

   Additional information regarding these issues is available at:
     * The Change Log for Apache 2.0, at:
       http://www.apache.org/dist/httpd/CHANGES_2.0
     * CERT VU#395412 at: http://www.kb.cert.org/vuls/id/395412
     * CVE-2006-3747 at:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3747
     * CVE-2005-3352 at:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352
     * CVE-2005-3357 at:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3357

2. Contributing Factors

   These issues can occur in the following releases:

   SPARC Platform
     * Solaris 10 without patch 120543-06

   x86 Platform
     * Solaris 10 without patch 120544-06

   Note 1: Apache 1.3 ships with Solaris 8, 9, and 10, and is impacted by
   two of the issues referenced in this Sun Alert - CVE-2005-3352 and
   CVE-2006-3747. For details on the impact to Apache 1.3 see Sun Alert
   102663.

   Note 2: The Apache 2.0 web server is not bundled with releases prior
   to Solaris 10. However, customers who have built and/or installed a
   vulnerable version of Apache on any version of Solaris are at risk.
   Refer to http://httpd.apache.org/security_report.html for
   information about vulnerable unbundled Apache versions.

   Note 3: A system is only vulnerable to the described issues if the
   Apache 2.0 web server has been configured and is running on the
   system. The following SMF command can be used to see if the Solaris 10
   bundled Apache 2 web server service is enabled:
    $ svcs svc:/network/http:apache2
    STATE          STIME    FMRI
    disabled       Feb_02   svc:/network/http:apache2

   Note 4: The mod_rewrite vulnerability (CVE-2006-3747) is present in
   Apache 2 versions 2.0.46 to 2.0.58 and Solaris 10 bundled Apache 2
   versions 2.0.46 to 2.0.58 built Aug 9 2006. The mod_ssl vulnerability
   (CVE-2005-3357) is present in Apache 2 versions 2.0 to 2.0.55. The
   mod_imap vulnerability (CVE-2005-3352) is present in Apache 2 versions
   2.0 to 2.0.56.

   To determine the version and build date of the Solaris bundled Apache
   2 web server installed on a host, the following command can be run:
    $ /usr/apache2/bin/httpd -v
    Server version: Apache/2.0.52
    Server built:   Jan 22 2006 02:10:22

   Note 5: The mod_rewrite vulnerability (CVE-2006-3747) only affects
   systems which make use of the Apache URL Rewriting Engine module
   (mod_rewrite). To determine if this module is enabled, a command such
   as the following can be run for all of the configuration files that
   define the running Apache configuration:
    $ grep RewriteEngine /etc/apache2/httpd.conf
    RewriteEngine on

   This option defaults to "off", therefore, if it is not present in the
   configuration files, the system is not affected.

   Note 6: The mod_ssl vulnerability (CVE-2005-3357) only affects systems
   which make use of the Apache SSL module (mod_ssl). If the Apache Web
   Server is configured to use the 'mod_ssl' module, text similar to the
   following will be printed to the error log when Apache is started:
    $ grep mod_ssl /var/apache2/logs/error_log
    [Tue Sep 26 17:23:13 2006] [notice] Apache/2.0.52 (Unix)
    DAV/2 mod_ssl/2.0.52 OpenSSL/0.9.7d mod_perl/2.0.0 Perl/v5.8.4 configured--
    resuming normal operations

   If no "mod_ssl" version information is displayed in the log when the
   application is started, the Apache 2 Web Server is not configured to
   use SSL.

   Note 7: The mod_imap vulnerability (CVE-2005-3352) only affects
   systems which make use of the Apache IMAP module (mod_imap) along with
   image map files. To determine if the mod_imap module is enabled for
   use with image map files, a command such as the following can be run
   for all of the configuration files that define the running Apache
   configuration:
    $ grep 'imap-file map' /etc/apache2/httpd.conf
    #AddHandler imap-file map

   This option is not enabled by default as the initial hash sign "#"
   indicates.

3. Symptoms

   There are no predictable symptoms that would indicate the described
   issues have been exploited on a system. 

4. Relief/Workaround

   To work around the mod_imap issue (CVE-2005-3352), disable the
   "imap-file map" entry in the Apache 2 httpd.conf file. The "imap-file
   map" entry should look like:
    #AddHandler imap-file map

   Refer to http://httpd.apache.org/docs/2.0/mod/mod_imap.html for
   details.

   To work around the mod_rewrite issue (CVE-2006-3747), disable the
   "RewriteEngine" option in the Apache 2 httpd.conf file. The
   RewriteEngine line should look like the following:
    RewriteEngine off

   Refer to http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html for
   details.

   There is no workaround for the mod_ssl issue (CVE-2005-3357).

5. Resolution

   These issues are addressed in the following releases:

   SPARC Platform
     * Solaris 10 with patch 120543-06 or later

   x86 Platform
     * Solaris 10 with patch 120544-06 or later

Change History

   01-Mar-2007:
     * Updated BugID field
     * Updated Relief/Workaround section

   This Sun Alert notification is being provided to you on an "AS IS"
   basis. This Sun Alert notification may contain information provided by
   third parties. The issues described in this Sun Alert notification may
   or may not impact your system(s). Sun makes no representations,
   warranties, or guarantees as to the information contained herein. ANY
   AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
   NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
   YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
   INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
   OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
   This Sun Alert notification contains Sun proprietary and confidential
   information. It is being provided to you pursuant to the provisions of
   your agreement to purchase services from Sun, or, if you do not have
   such an agreement, the Sun.com Terms of Use. This Sun Alert
   notification may only be used for the purposes contemplated by these
   agreements.

   Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa
   Clara, CA 95054 U.S.A. All rights reserved

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRe5Zoih9+71yA2DNAQIr1wQAhMzjkmRV0KsQVoihjSWHFPE1hpxTOfk4
I48PAcDBRTjUw6qn3gPKAHy8GC9e9U481i8hn1hi6Zi2FU22LwkzQEsxOTkxMRR6
wL3AKUwOcqdQ+8w/Q/Wr5otd8TiRf/Y6gDYb10RmU/JX5lba3QYEqhtCch7yGPG4
7Ux6hxnvc/E=
=xs4h
-----END PGP SIGNATURE-----