SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Apache HTTPD Vendors:   Apache Software Foundation
Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
SecurityTracker Alert ID:  1018304
SecurityTracker URL:  http://securitytracker.com/id/1018304
CVE Reference:   CVE-2007-3304   (Links to External Site)
Date:  Jun 26 2007
Impact:   Denial of service via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.3.x, 2.2.x
Description:   A vulnerability was reported in Apache HTTPD. A local user can cause denial of service conditions.

The server does not verify that a process is actually an Apache child process before sending signals to the process. A local user with the ability to run scripts can modify the scoreboard arrays to reference arbitrary process IDs and cause arbitrary processes to be terminated.

The vendor was notified on May 16, 2006.

PSNC Security Team discovered this vulnerability.

Impact:   A local user with privileges to run scripts on the target system can terminate arbitrary processes on the target system.
Solution:   The vendor has issued a fix, available via SVN at:

http://svn.apache.org/viewvc?view=rev&rev=547987

Vendor URL:  httpd.apache.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jun 26 2007 (Red Hat Issues Fix) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
Red Hat has released a fix for Red Hat Enterprise Linux 2.1.
Jun 27 2007 (Red Hat Issues Fix) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
Red Hat has released a fix for Red Hat Enterprise Linux 5.
Jul 13 2007 (Red Hat Issues Fix) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
Red Hat has released a fix for Red Hat Enterprise Linux 3 and 4.
Jul 13 2007 (Red Hat Issues Fix) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
Red Hat has released a fix for Red Hat Application Stack.
Sep 10 2007 (IBM Issues Fix for IBM HTTP Server) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
IBM has issued a fix for the IBM HTTP Server.
Feb 20 2008 (Sun Issues Fix) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
Sun has issued a fix for Solaris 8, 9, and 10.
May 20 2008 (Red Hat Issues Fix for Red Hat Network Proxy Server) Apache HTTPD scoreboard Protection Flaw Lets Local Users Terminate Arbitrary Processes
Red Hat has released a fix for Red Hat Network Proxy 5.0.



 Source Message Contents

Subject:  Apache httpd vulenrabilities

PSNC Security Team has got the pleasure to announce that, as a result of 
Apache httpd server (ver. 1.3.x, 2.0.x and 2.2.x) source code analysis, 
several vulnerabilities have been found that make it possible to perfom a 
DoS attack against the services and the system that the application is 
running on. Below the basic information on found vulnerabilities may be 
found:

Vuln#1
Httpd Server DoS
Test environment: ver. 2.0.59, 2.2.4, prefork mpm module

An appropriate code run in the worker process context makes it possible to 
kill all worker processes with simultaneous blocking of creating new 
worker processes by the master process. As a result, the server stops to 
accept and handle new connections.

Vuln #2
SIGUSR1 killer
Test environment: ver. 2.0.59, 2.2.4 prefork mpm module

An appropriate code run in the worker process context makes it possible to 
send SIGUSR1 signals by the master process (that runs with root 
credentials) to an arbitrary process within the system.

Vuln #3
SIGUSR1 killer
Test environment: ver 1.3.37

An appropriate code run in the worker process context makes it possible to 
send SIGUSR1 signals by the master process (that runs with root 
credentials) to an arbitrary process within the system.

Vuln #4
System DoS
Test environment: ver 2.0.59, 2.2.4 prefork mpm module

An appropriate code run in the worker process context makes it possible to 
force the master process to create an unlimited amount of new worker 
processes. As a result, the activity of the whole system may be blocked.


Countermeasures:

Disabling the possibility of running the user.s code in the worker process 
context. An especial emphasis should be put on programming languages that 
may be configures as an Apache module (like mod_php, mod_perl etc.) in 
order to block dangerous functions, e.g. dl(), dlopen().




The information on the vulnerabilities above was sent to Apache Software 
Foundation on 16 May, 2006. For over 1 year no official patch has been 
issued. PSNC Security Team is currently working on its own, unofficial 
patches. Our patches will be published on 18 June, 2007 on the team 
webpage (http://security.psnc.pl). On 20 June, 2007 the detailed 
information on the found vulnerabilities will be issued.


PSNC Security Team

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC