Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.1671
X509 Client certificate based authentication can be bypassed
when HTTP/2 is used
6 July 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apache HTTPD WebServer
Publisher: The Apache Software Foundation
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-4979
Original Bulletin:
http://mail-archives.apache.org/mod_mbox/httpd-users/201607.mbox/CVE-2016-4979-68338
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Security Advisory - Apache Software Foundation
Apache HTTPD WebServer / httpd.apache.org
X509 Client certificate based authentication can
be bypassed when HTTP/2 is used
CVE-2016-4979 / CVSS 7.5
The Apache HTTPD web server (from 2.4.18-2.4.20) did not validate a X509
client certificate correctly when experimental module for the HTTP/2
protocol is used to access a resource.
The net result is that a resource that should require a valid client certificate
in order to get access can be accessed without that credential.
Background:
- - -----------
Apache can control access to resources based on various things; such as
a password, IP address and so on. One of the options, when SSL or TLS is
used, is gating access based on the client having access to a private-key of
a X509 client certificate. These client certificates are typically held on
a chipcard (e.g. the CAC card in the US, national identity, banking cards
or, for example, medical-chip cards in Europe). In some cases they
are 'soft tokens' - i.e. files, often called PKCS#12 files, which are loaded
into the browser or the 'keychain'.
Gating access based on a client certificate is done by adding a line such as
SSLVerifyClient require
to the httpd configuration; along with a list of trusted client certificate
authorities (SSLCACertificateFile).
Version 2.4.17 of the Apache HTTP Server introduced an experimental feature:
mod_http2 for the HTTP/2 protocol (RFC7540, previous versions were known as
Google SPDY).
This module is NOT compiled in by default -and- is not enabled by default,
although some distribution may have chosen to do so.
It is generally needs to be enabled in the 'Protocols' line in httpd by
adding 'h2' and/or 'h2c' to the 'http/1.1' only default.
The default distributions of the Apache Software Foundation do not include
this experimental feature.
Details:
- - --------
- - From version 2.4.18, upto and including version 2.4.20 the server failed
to take the (failed/absent) client certificate validation into account
when providing access to a resource over HTTP/2. This issue has been fixed
in version 2.4.23 (r1750779).
As a result - a resource thought to be secure and requiring a valid
client certificate - would be accessible without authentication
provided that the mod_http2 was loaded, h2 or h2c activated, that
that the browser used the HTTP/2 protocol and it would do more than
one request over a given connection.
Impact:
- - -------
A third party can gain access to resources on the web server without
the requisite credentials.
This can then lead to unauthorised disclosure of information.
Versions affected:
- - ------------------
All versions from 2.4.18 to 2.4.20. The issue is fixed in
version 2.4.23 (released 2015-6-5)
Resolution:
- - -----------
Upgrade to version 2.4.23 or newer.
Mitigations and work arounds:
- - -----------------------------
As a temporary workaround - HTTP/2 can be disabled by changing
the configuration by removing h2 and h2c from the Protocols
line(s) in the configuration file.
The resulting line should read:
Protocols http/1.1
Credits and timeline
- - --------------------
The flaw was found and reported by Erki Aring <erki@example.ee>
from Liewenthal Electronics Ltd on 2016-06-30. The issue was
resolved by Stefan Eissing that same day and incorporated in
the release of 5th of July 2015 (thus avoiding a bank holiday).
Apache would like to thank all involved for their help with this.
Common Vulnerability Scoring (Version 3) and vector
- - ---------------------------------------------------
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C
CVSS Base Score 7.5
CVSS Temporal Score 7.0
1.05 / : 2339 $
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4
Comment: This message is encrypted and/or signed with PGP (gnu-pg, gpg). Contact dirkx@webweaving.org if you cannot read it.
iEYEARECAAYFAld7tREACgkQ/W+IxiHQpxssBwCg2PU1xiye20scB23ZEAdhuEjA
JPoAmwUaZFh/tr2tR3opAVnFo+mSgMDi
=zNG2
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBV3xQwox+lLeg9Ub1AQhVbhAAgYxmdGP+YNmp9BGSgizG0DysH3Nz8EXA
7V8/XeckxBLYCY3EfkhkWttEJvLfXlpTFDsnG5c2fHEa06l9ArxrvfcuCzrTh/Lu
3JEt39HnVNLZ/HQezZQBpBApwfHExlVsnf6hYcpDQou+IfAf8XLaMT45OjIy3Xaf
07THfshd+tlGj2f3zdGqSXoVxgkg8S4m56aIoMh8kT0/8fVv87HwTqwMi2S6w85Q
fuOMi137hKnTtQoOgMmmZLTW0fAclilWT1Vli/5wVDAY0iz04s2tF0sdtxdC0pKV
baF5MuqAWngvviXGBNRmFFcWoAsMAcqkcJ3AbddtLLtyiwmCYZ2ZUxlk6DZmi8D9
5L39n/eSQmvNGsN1BWq5mBvRLUpgcxhpoCDKHmIH1fATAMD4kPa34ujMvJcVFusm
ri8GcF/BgLlNkrBU9iVI1sdt4gSJXvbH4uOWfZfelAIo/Fm0ggohO3v7NL4jzv1W
4RbhNPwJLHg2QMzNeuGNcBHIaqK5Yz0ujxhY6EjxJnFbAIjv8hX52/fVKcGF5Ru5
YClQmiyux9+BhL0/Lz27z+eyTKXH78SCNvUM/jkwgy3M9hZJYcrHxnaMVVz8ya7v
IkKZeXuNbNDnXWXQs8wHNjmRiqmI2kfPWYCedyb4rbbzC3hiuptjWaYvzEIcAhxZ
nqXsu8Tmi08=
=5nu0
-----END PGP SIGNATURE-----