CVE-2011-4415: Input Validation
First published: Wed Nov 02 2011(Updated: )
It was reported [1] that an integer overflow was found in Apache in the ap_pregsub() function called from mod-setenvif. When a header field is mangled using SetEnvIf, the new environment variable data can be multiples of the size of the submitted header field. This would cause ap_pregsub() to overflow the length value in buffer size calculations, leading to the subsequent allocation call of a too-small buffer. Filling this buffer with user-supplied data will lead to a buffer overflow. Depending on the input data, this can lead to excessive allocation of server memory (resulting in killed processes due to out-of-memory conditions), invalid memory access when copying large amounts of data (which can lead to a termination of the httpd process), or possibly allowing the execution of arbitrary code. To trigger this flaw, mod_setenvif must be enabled (the default) and the attacker needs to be able to place a crafted .htaccess file on the server (which, in most cases, would require local access to the file system or some web interface that allows for writing arbitrary files to the local file system, such as for custom .htaccess files). There is currently no upstream fix, however to work around the problem, disable mod_setenvif. [1] <a href="http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/">http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache HTTP server | =2.0.42 | |
| Apache HTTP server | =2.0.64 | |
| Apache HTTP server | =2.0.58 | |
| Apache HTTP server | =2.0.47 | |
| Apache HTTP server | =2.0.56 | |
| Apache HTTP server | =2.0.50 | |
| Apache HTTP server | =2.0.35 | |
| Apache HTTP server | =2.0.37 | |
| Apache HTTP server | =2.0.55 | |
| Apache HTTP server | =2.0.44 | |
| Apache HTTP server | =2.0.39 | |
| Apache HTTP server | =2.0.52 | |
| Apache HTTP server | =2.0.53 | |
| Apache HTTP server | =2.0.57 | |
| Apache HTTP server | =2.0.51 | |
| Apache HTTP server | =2.0.28-beta | |
| Apache HTTP server | =2.0.63 | |
| Apache HTTP server | =2.0.41 | |
| Apache HTTP server | =2.0.49 | |
| Apache HTTP server | =2.0.9 | |
| Apache HTTP server | =2.0.34-beta | |
| Apache HTTP server | =2.0.61 | |
| Apache HTTP server | =2.0.32 | |
| Apache HTTP server | =2.0.38 | |
| Apache HTTP server | =2.0.48 | |
| Apache HTTP server | =2.0.45 | |
| Apache HTTP server | =2.0.40 | |
| Apache HTTP server | =2.0.36 | |
| Apache HTTP server | =2.0.46 | |
| Apache HTTP server | =2.0.54 | |
| Apache HTTP server | =2.0.43 | |
| Apache HTTP server | =2.0.59 | |
| Apache HTTP server | =2.0.28 | |
| Apache HTTP server | =2.0 | |
| Apache HTTP server | =2.0.32-beta | |
| Apache HTTP server | =2.0.60 | |
| Apache HTTP server | =2.2.11 | |
| Apache HTTP server | =2.2.0 | |
| Apache HTTP server | =2.2.10 | |
| Apache HTTP server | =2.2.13 | |
| Apache HTTP server | =2.2.2 | |
| Apache HTTP server | =2.2.4 | |
| Apache HTTP server | =2.2.16 | |
| Apache HTTP server | =2.2.21 | |
| Apache HTTP server | =2.2.8 | |
| Apache HTTP server | =2.2.14 | |
| Apache HTTP server | =2.2.6 | |
| Apache HTTP server | =2.2.19 | |
| Apache HTTP server | =2.2.9 | |
| Apache HTTP server | =2.2.18 | |
| Apache HTTP server | =2.2.12 | |
| Apache HTTP server | =2.2.3 | |
| Apache HTTP server | =2.2.15 | |
| Apache HTTP server | =2.2.20 | |
| Apache HTTP server | =2.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html
- http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/
- http://www.gossamer-threads.com/lists/apache/dev/403775
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
- https://www.cve.org/CVERecord?id=CVE-2011-4415 https://nvd.nist.gov/vuln/detail/CVE-2011-4415
- https://bugzilla.redhat.com/show_bug.cgi?id=750935
- https://access.redhat.com/security/cve/CVE-2011-4415
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=750937
- https://access.redhat.com/security/cve/CVE-2011-3607
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3607
- http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html
- https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/811422
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=750935
- http://www.securityfocus.com/bid/50494
- http://www.osvdb.org/76744
- http://securitytracker.com/id?1026267
- http://secunia.com/advisories/45793
- http://xforce.iss.net/xforce/xfdb/71093
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4415
- http://svn.apache.org/viewvc?view=revision&revision=1198940
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=750935#c4
- http://thread.gmane.org/gmane.comp.apache.devel/46260
- http://thread.gmane.org/gmane.comp.apache.devel/46339
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=750935#c6
- http://thread.gmane.org/gmane.comp.apache.devel/46339/focus=46768
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=769844
- http://thread.gmane.org/gmane.comp.apache.devel/46339/focus=46783
- collector/nvd-historical
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/weakness
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-4415
- agent/author
- agent/references
- agent/remedy
- agent/severity
- agent/description
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/apache
- canonical/apache http server
- version/apache http server/2.0.42
- version/apache http server/2.0.64
- version/apache http server/2.0.58
- version/apache http server/2.0.47
- version/apache http server/2.0.56
- version/apache http server/2.0.50
- version/apache http server/2.0.35
- version/apache http server/2.0.37
- version/apache http server/2.0.55
- version/apache http server/2.0.44
- version/apache http server/2.0.39
- version/apache http server/2.0.52
- version/apache http server/2.0.53
- version/apache http server/2.0.57
- version/apache http server/2.0.51
- version/apache http server/2.0.28-beta
- version/apache http server/2.0.63
- version/apache http server/2.0.41
- version/apache http server/2.0.49
- version/apache http server/2.0.9
- version/apache http server/2.0.34-beta
- version/apache http server/2.0.61
- version/apache http server/2.0.32
- version/apache http server/2.0.38
- version/apache http server/2.0.48
- version/apache http server/2.0.45
- version/apache http server/2.0.40
- version/apache http server/2.0.36
- version/apache http server/2.0.46
- version/apache http server/2.0.54
- version/apache http server/2.0.43
- version/apache http server/2.0.59
- version/apache http server/2.0.28
- version/apache http server/2.0
- version/apache http server/2.0.32-beta
- version/apache http server/2.0.60
- version/apache http server/2.2.11
- version/apache http server/2.2.0
- version/apache http server/2.2.10
- version/apache http server/2.2.13
- version/apache http server/2.2.2
- version/apache http server/2.2.4
- version/apache http server/2.2.16
- version/apache http server/2.2.21
- version/apache http server/2.2.8
- version/apache http server/2.2.14
- version/apache http server/2.2.6
- version/apache http server/2.2.19
- version/apache http server/2.2.9
- version/apache http server/2.2.18
- version/apache http server/2.2.12
- version/apache http server/2.2.3
- version/apache http server/2.2.15
- version/apache http server/2.2.20
- version/apache http server/2.2.1