(Conectiva Issues Fix) Apache Web Server Virtual Hosting Split-Logfile Function Lets Remote Users Write Log Entries to Arbitrary Files on the System
|
|
SecurityTracker Alert ID: 1002579 |
|
SecurityTracker URL: http://securitytracker.com/id/1002579
|
|
CVE Reference:
CAN-2001-0730
(Links to External Site)
|
Date: Oct 18 2001
|
Impact:
Modification of system information, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.3.20; possibly earlier versions
|
Description:
A vulnerability was reported in the Apache web server. Under a certain configuration, a remote user can cause a log file entry to be appended to any file on the system that is writable by the web server.
If the Apache server is configured to support virtual hosts and uses split-logfiles to separate the log file by host name, the vulnerability can be triggered.
A remote user can specify "/" as the HTTP 'Host:' field to cause an error to occur and a line to be added to any file in the filesystem that is writable by the web server's split-logfile process:
GET / HTTP/1.0
Host: /
|
Impact:
A remote user can cause a log file entry to be written to any file on the system thta is writable by the split-logfile process.
|
Solution:
The vendor notes that Conectiva is not shipped with this vulnerability, but that users could manually reconfigure Apache in a vulnerable manner. The vendor has released a fix:
ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/apache-1.3.22-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-devel-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-doc-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/apache-1.3.22-U51_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-1.3.22-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-devel-1.3.22-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-doc-1.3.22-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.22-U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.22-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.22-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.22-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.22-U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.22-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.22-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.22-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/SRPMS/apache-1.3.22-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache-devel-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache-doc-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/SRPMS/apache-1.3.22-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-devel-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-doc-1.3.22-U50_1cl.i386.rpm
See the Source Message for instructions on automatically upgrading.
|
Vendor URL: www.apache.org/ (Links to External Site)
|
Cause:
Input validation error, State error
|
Underlying OS:
Linux (Conectiva)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 18 Oct 2001 18:58:18 -0200
Subject: [conectiva-updates] [CLA-2001:430] Conectiva Linux Security Announcement - apache
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : apache
SUMMARY : Remote vulnerabilities in Apache < 1.3.22
DATE : 2001-10-18 18:54:00
ID : CLA-2001:430
RELEVANT
RELEASES : 5.0, prg graficos, ecommerce, 5.1, 6.0, 7.0
- -------------------------------------------------------------------------
DESCRIPTION
Apache is a robust, commercial-grade web server.
Security problems have been found in the Apache packages shipped with
all versions of Conectiva Linux. This update fixes the following
vulnerabilities:
* A intentionally malformed Host: header could allow any file with
a .log extention to be overwritten due to a problem in the
split-logfile script. Conectiva Linux does not ship split-logfile,
but users who may have installed this script manually are thus
advised to check their systems for this vulnerability. [1]
* When Multiviews are used to negotiate the directory index, under
certain conditions a request for the URI /?M=D could return a
directory listing rather than negotiated content. [2] [3]
Additionally, this update solves a problem in mod_bandwidth shipped
with Conectiva Linux 7.0. [4]
REFERENCES
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0730
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0731
[3] http://www.securityfocus.com/bid/3009
[4] http://bugzilla.conectiva.com.br/show_bug.cgi?id=4371
SOLUTION
All affected users should upgrade their packages.
DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/apache-1.3.22-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-devel-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-doc-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/apache-1.3.22-U51_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-1.3.22-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-devel-1.3.22-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-doc-1.3.22-U51_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.22-U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.22-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.22-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.22-U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.22-U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.22-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.22-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.22-U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/SRPMS/apache-1.3.22-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache-devel-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache-doc-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/SRPMS/apache-1.3.22-U50_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-devel-1.3.22-U50_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-doc-1.3.22-U50_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades of RPM packages:
- add the following line to /etc/apt/sources.list if it is not there yet
(you may also use linuxconf to do this):
rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates
(replace 6.0 with the correct version number if you are not running CL6.0)
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE7z0Jo42jd0JmAcZARAs7eAJ9vxHsjmYoXWm78thi20zUstubztwCgwln7
FmzF3ZqxBoVtNeMT9apw3mY=
=Kc7T
-----END PGP SIGNATURE-----
|
|
