AusCERT - ESB-2006.0761 -- [Solaris] -- Security Vulnerabilities in the Apache 1.3 Web Server "mod_rewrite" and "mod

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2006.0761 -- [Solaris] -- Security Vulnerabilities in the Apache 1.3 Web Server "mod_rewrite" and "mod_imap" Modules
Date: 06 March 2007
References: AL-2006.0061

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                        ESB-2006.0761 -- [Solaris]
           Security Vulnerabilities in the Apache 1.3 Web Server
                   "mod_rewrite" and "mod_imap" Modules
                              13 October 2006

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              mod_rewrite and mod_imap Apache 1.3 modules
Publisher:            Sun Microsystems
Operating System:     Solaris 8,9,10
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
                      Cross-site Scripting
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-3747 CVE-2005-3352

Ref:                  AL-2006.0061

Original Bulletin:    
  http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102663-1

Revision History:  March    7 2007: Minor adjustments to Workaround section
                   December 6 2006: Issue has been resolved
                   October 13 2006: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

Sun(sm) Alert Notification
     * Sun Alert ID: 102663
     * Synopsis: Security Vulnerabilities in the Apache 1.3 Web Server
       "mod_rewrite" and "mod_imap" Modules
     * Category: Security
     * Product: Solaris 9 Operating System, Solaris 10 Operating System,
       Solaris 8 Operating System
     * BugIDs: 6452767, 6423037, 6423033
     * Avoidance: Patch, Workaround
     * State: Resolved
     * Date Released: 11-Oct-2006, 04-Dec-2006
     * Date Closed: 04-Dec-2006
     * Date Modified: 04-Nov-2006, 02-Mar-2007

1. Impact

   Two security vulnerabilities have been found in the Apache HTTP server
   which affect the Apache 1.3 web server bundled with Solaris 8, 9, and
   10.

   The first issue, a vulnerability in the mod_rewrite Apache HTTP server
   module (CVE-2006-3747), may allow a local or remote unprivileged user
   to execute arbitrary code with the privileges of the Apache 1.3
   process, or cause a Denial of Service (DoS) to the Apache HTTP
   process. The Apache process normally runs as the unprivileged user
   "nobody" (uid 60001).

   The second issue, a Cross Site Scripting (CSS or XSS) vulnerability in
   the mod_imap Apache HTTP server module (CVE-2005-3352), may allow a
   local or remote unprivileged user to steal cookie information, hijack
   sessions, or cause a loss of data privacy between a client and the
   server.

   Additional information regarding these issues is available at:
     * The Change Log for Apache 1.3, at:
       http://www.apache.org/dist/httpd/CHANGES_1.3
     * CERT VU#395412 at: http://www.kb.cert.org/vuls/id/395412
     * CVE-2006-3747 at:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3747
     * CVE-2005-3352 at:
       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352

2. Contributing Factors

   These issues can occur in the following releases:

   SPARC Platform
     * Solaris 8 with patches 116973-01 through 116973-04 and
       without patch 116973-05
     * Solaris 9 with patches 113146-03 through 113146-07 and
       without patch 113146-08
     * Solaris 10 without patch 122911-02

   x86 Platform
     * Solaris 8 with patches 116974-01 through 116974-04 and
       without patch 116974-05
     * Solaris 9 with patches 114145-02 through 114145-06 and
       without patch 114145-07
     * Solaris 10 without patch 122912-02

   Note 1: Apache 2.0 ships with Solaris 10 and is impacted by the issues
   referenced in this Sun Alert. For details on the impact to Apache 2.0
   see Sun Alert 102662.

   Note 2: A system is only vulnerable to these issues if the Apache 1.3
   web server has been configured and is running on the system. The
   following command can be executed to determine if the Apache(1M) httpd
   daemon is currently running on the system:
    $ /usr/bin/ps -ef | grep httpd
    nobody 103892 102307 0 Jan 20 ? 0:27 /usr/apache/bin/httpd

   The Solaris bundled Apache 1.3 web server will start automatically at
   boot time if the file "/etc/apache/httpd.conf" exists, and
   "/etc/rc3.d/S50apache" has not been disabled.

   Customers who have built and/or installed a vulnerable version of
   Apache on any version of Solaris are at risk. Refer to
   http://httpd.apache.org/security_report.html for information about
   vulnerable unbundled Apache versions.

   Note 3: The mod_rewrite vulnerability (CVE-2006-3747) is present in
   Apache versions 1.3.28 to 1.3.36 and Solaris 10 bundled Apache 1.3
   versions 1.3.28 to 1.3.35, Solaris 9 bundled Apache 1.3 versions
   1.3.28 to 1.3.35.

   The mod_rewrite vulnerability is addressed in the patches listed in
   the "Resolution" section of this Sun Alert which update Apache 1.3 to
   1.3.36 built Sep 5 2006 for Solaris 10.

   To determine the version and build date of the Solaris bundled Apache
   1.3 web server installed on a host, the following command can be run:
    $ /usr/apache/bin/httpd -v
    Server version: Apache/1.3.31 (Unix)
    Server built:   Jun 30 2005 05:48:24

   Note 4: The mod_rewrite vulnerability (CVE-2006-3747) only affects
   systems which make use of the Apache URL Rewriting Engine module
   (mod_rewrite). To determine if this module is enabled, a command such
   as the following can be run for all of the configuration files that
   define the running Apache configuration:
    $ grep RewriteEngine /etc/apache/httpd.conf
    RewriteEngine on

   This option defaults to "off", therefore, if it is not present in the
   configuration files, the host is not affected.

   Note 5: The mod_imap vulnerability (CVE-2005-3352) only affects
   systems which make use of the Apache IMAP module (mod_imap) along with
   image map files. To determine if the mod_imap module is enabled for
   use with image map files, a command such as the following can be run
   for all of the configuration files that define the running Apache
   configuration:
    $ grep 'imap-file map' /etc/apache2/httpd.conf
    #AddHandler imap-file map

   This option is not enabled by default as the initial hash sign '#'
   indicates.

3. Symptoms

   There are no predictable symptoms that would indicate the described
   issues have occurred. 

4. Relief/Workaround

   To workaround the mod_rewrite issue (CVE-2006-3747), disable the
   "RewriteEngine" option in the Apache 1.3 httpd.conf file.  The
   RewriteEngine line should look like:
    RewriteEngine off

   Refer to http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html for
   details.

   To workaround the mod_imap issue (CVE-2005-3352), disable the
   "imap-file map" entry in the Apache 1.3 httpd.conf file. The
   "imap-file map" entry should look like:
    #AddHandler imap-file map

   Refer to http://httpd.apache.org/docs/1.3/mod/mod_imap.html for
   details.

5. Resolution

   These issues are addressed in the following releases:

   SPARC Platform
     * Solaris 8 with patch 116973-05 or later
     * Solaris 9 with patch 113146-08 or later
     * Solaris 10 with patch 122911-02 or later


   x86 Platform
     * Solaris 8 with patch 116974-05 or later
     * Solaris 9 with patch 114145-07 or later
     * Solaris 10 with patch 122912-02 or later

Change History

   04-Nov-2006:
     * State: Resolved
     * Updated Contributing Factors and Resolution sections

   02-Mar-2007:
     * Updated BugID field
     * Updated Contributing Factors and Relief/Workaround sections.

   This Sun Alert notification is being provided to you on an "AS IS"
   basis. This Sun Alert notification may contain information provided by
   third parties. The issues described in this Sun Alert notification may
   or may not impact your system(s). Sun makes no representations,
   warranties, or guarantees as to the information contained herein. ANY
   AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
   WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
   NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
   YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
   INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
   OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
   This Sun Alert notification contains Sun proprietary and confidential
   information. It is being provided to you pursuant to the provisions of
   your agreement to purchase services from Sun, or, if you do not have
   such an agreement, the Sun.com Terms of Use. This Sun Alert
   notification may only be used for the purposes contemplated by these
   agreements.

   Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa
   Clara, CA 95054 U.S.A. All rights reserved

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRe5cySh9+71yA2DNAQJzxgP+LIbLS1dac8UjVMo/fbzY2JM4E9/Gqa3z
Y4gh8FnBFB0+llgNaE+isfSDpzpmqRS1NmZVSGtqXxYyV3vGYx3AYQ9IQY2pRIip
1gEkq38hpP5bW1NLzIx5RZ+e5UyRNFahheyp9+f5ofN11baYIB/dSNHp3EGkfYx1
fKMQfNaroUA=
=m5kQ
-----END PGP SIGNATURE-----