CVE-2009-1195: Medium severity apache http server vulnerability

Description of problem:

In an httpd.conf fragment like:

<Directory ...somepath...> AllowOverride ... Options=IncludesNoEXEC </Directory>

that appears to limit what Options can be set in .htaccess to just IncludeNoexec, but in fact Options Includes is also allowed. I assume that this is an upstream bug but I've not checked if any RH patches touch this part of the code.

Version-Release number of selected component (if applicable):

httpd-2.2.3-22.el5

How reproducible:

100%

Steps to Reproduce: 1. Add a <directory> which permits AllowOverride Options=IncludesNoEXEC 2. create a .htaccess in there and use Options Includes 3. access a file using ssi with #exec Actual results:

the #exec is executed

Expected results:

includesnoexec only should be allowed ie no exec or cgi.

Additional info:

In the httpd source (as patched by the srpm etc), in server/core.c at about line 1288 we have the definition of setallowopts() which contains:

... else if (!strcasecmp(w, "Includes")) { opt = OPTINCLUDES; } else if (!strcasecmp(w, "IncludesNOEXEC")) { opt = (OPTINCLUDES | OPTINCNOEXEC); } ...

I think that should probably be:

... else if (!strcasecmp(w, "Includes")) { opt = (OPTINCLUDES | OPTINCNOEXEC); } else if (!strcasecmp(w, "IncludesNOEXEC")) { opt = OPTINCNOEXEC; } ...

since there is (as far as I can see) no harm allowing the user to specify IncludesNoExec if you allow them to use Includes but not the other way round.

Of course my understanding of the logic in setoptions() might well be flawed but it seems that at least one of the bits set in overrideopts must be set in opt to allow it so the change above looks to do what I would expect - though this might not be what others expect it to mean - ie I might well be misunderstanding what AllowOverride ... Options=IncludesNoEXEC should mean.