Peter Valchev discovered a flaw in the way expat handled malformed UTF-8 sequences when processing XML files. Incorrect UTF-8 sequenced could cause expat to fail to properly detect end of input and continue reading behind the end of input buffer. This results in a crash once reading reaches unmapped memory.

Non-public upstream bug report: http://sourceforge.net/tracker/?func=detail&aid=1990430&groupid=10127&atid=110127

Contents of the report leaked via expat-bugs mailing list posts: http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html

Upstream patch: http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltokimpl.c?r1=1.13&r2=1.15

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=551936 https://bugs.gentoo.org/showbug.cgi?id=280615

The logcookie function in modlogconfig.c in the modlogconfig module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

The davxmlgetcdata function in main/util.c in the moddav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Apache HTTP Server 2.4.16 release fixes the following issue:

) SECURITY: CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect. Remove aprbrigadeflatten(), buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. [Graham Leggett, Yann Ylavic]

External References:

http://www.apache.org/dist/httpd/CHANGES2.4.16

Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.

Discussion and a possible patch is available from the following thread:

http://marc.info/?t=138219209900002&r=1&w=2

References:

http://martin.swende.se/blog/HTTPChunked.html

Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15

moderate: modproxyajp DoS CVE-2010-0408

modproxyajp would return the wrong status code if it encountered an error causing a backend server to be put into an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in a denial of service.

Affects: 2.2.0 - 2.2.14

Upstream commit: http://svn.apache.org/viewvc?view=revision&revision=917876

Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15

low: Request header information leak CVE-2010-0434

A bug in the handling of headers in subrequests could lead to a reuse of memory. In a multithreaded MPM this could possibly cause an information leak from other requests being handled by a different thread.

Affects: 2.2.0 - 2.2.14

Upstream bug: https://issues.apache.org/bugzilla/showbug.cgi?id=48359

Upstream commits (2.2.x branch): http://svn.apache.org/viewvc?view=revision&revision=917867 http://svn.apache.org/viewvc?view=revision&revision=918427

envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.

Cross-site scripting (XSS) vulnerability in modautoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.

Apache Portable Runtime (APR) is vulnerable to a denial of service, caused by an error in the aprfnmatch() function when processing specific patterns with the "" wildcard. A remote attacker could exploit this vulnerability to consume all available CPU and memory resources resulting in a denial of service.

Expat is vulnerable to a denial of service, caused by the improper handling of XML data by the big2toUtf8 function within the libexpat library. A remote attacker could exploit this vulnerability using a specially-crafted XML document containing malformed UTF-8 sequences that trigger a buffer over-read to cause the application to crash.

Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

Cross-site scripting (XSS) vulnerability in modstatus.c in the modstatus module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform "charset detection" when the content-type is not specified.

Cross-site scripting (XSS) vulnerability in modstatus in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in the balancer-manager in modproxybalancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.

Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.

Cross-site scripting (XSS) vulnerability in the (1) modimap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) modimagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The date handling code in modules/proxy/proxyutil.c (modproxy) in Apache 2.3.0, when using a threaded MPM, allows remote origin servers to cause a denial of service (caching forward proxy process crash) via crafted date headers that trigger a buffer over-read.

Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the workerscore and processscore arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."

cacheutil.c in the modcache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.

Cross-site scripting (XSS) vulnerability in proxyftp.c in the modproxyftp module in Apache 2.0.63 and earlier, and modproxyftp.c in the modproxyftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

The approxyhttpprocessresponse function in modproxyhttp.c in the modproxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

Cross-site scripting (XSS) vulnerability in the modnegotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.

modproxyftp in Apache 2.2.x before 2.2.7-dev, 2.0.x before 2.0.62-dev, and 1.3.x before 1.3.40-dev does not define a charset, which allows remote attackers to conduct cross-site scripting (XSS) attacks using UTF-7 encoding.

The modproxyftp module in the Apache HTTP Server allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server via vectors related to the embedding of these commands in the Authorization HTTP header, as demonstrated by a certain module in VulnDisco Pack Professional 8.11. NOTE: as of 20090903, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.

References: http://intevydis.com/vd-list.shtml

A single NULL byte buffer overflow flaw was found in apr-util's aprbrigadevprintf() function.

First let's assume the worst case and an attacker can control exactly what is being sent to aprbrigadevprintf and can trigger this issue by filling the buckets just right so you end up with one that is perfectly full as per the explanation at http://www.mail-archive.com/dev@apr.apache.org/msg21592.html

632 APUDECLARE(aprstatust) aprbrigadevprintf(aprbucketbrigade b, ... 638 struct brigadevprintfdatat vd; 639 char buf[APRBUCKETBUFFSIZE]; 640 aprsizet written; ... 656 (vd.vbuff.curpos) = '\0'; ... 659 return aprbrigadewrite(b, flush, ctx, buf, vd.vbuff.curpos - buf);

If we get to line 656 with vd.vbuff.curpos pointing to one past the end of buf we write a single NULL to the next thing on the stack after buf. And on the Linux x86 and x8664 builds we looked at this is actually the first byte of the vd structure, which is in fact the LSB of vd.vbuff.curpos itself.

So the only use of this after the overwrite is on line 659 where vd.vbuff.curpos gets used to calculate how much to write. Before the overwrite vd.vbuff.curpos was buf+APRBUCKETBUFFSIZE (8000), but now it could be between 0 and 255 bytes less. So aprbrigadewrite will end up writing out between 0 and 255 bytes less than it ought to, causing the truncation seen in the original bug report.

So for little endian systems it doesn't seem to have any security consequence. Of course for a big endian system aprbrigadewrite could end up dumping large amounts of memory (so an info disclosure leak or crash).

Description of problem:

In an httpd.conf fragment like:

<Directory ...somepath...> AllowOverride ... Options=IncludesNoEXEC </Directory>

that appears to limit what Options can be set in .htaccess to just IncludeNoexec, but in fact Options Includes is also allowed. I assume that this is an upstream bug but I've not checked if any RH patches touch this part of the code.

Version-Release number of selected component (if applicable):

httpd-2.2.3-22.el5

How reproducible:

100%

Steps to Reproduce: 1. Add a <directory> which permits AllowOverride Options=IncludesNoEXEC 2. create a .htaccess in there and use Options Includes 3. access a file using ssi with #exec Actual results:

the #exec is executed

Expected results:

includesnoexec only should be allowed ie no exec or cgi.

Additional info:

In the httpd source (as patched by the srpm etc), in server/core.c at about line 1288 we have the definition of setallowopts() which contains:

... else if (!strcasecmp(w, "Includes")) { opt = OPTINCLUDES; } else if (!strcasecmp(w, "IncludesNOEXEC")) { opt = (OPTINCLUDES | OPTINCNOEXEC); } ...

I think that should probably be:

... else if (!strcasecmp(w, "Includes")) { opt = (OPTINCLUDES | OPTINCNOEXEC); } else if (!strcasecmp(w, "IncludesNOEXEC")) { opt = OPTINCNOEXEC; } ...

since there is (as far as I can see) no harm allowing the user to specify IncludesNoExec if you allow them to use Includes but not the other way round.

Of course my understanding of the logic in setoptions() might well be flawed but it seems that at least one of the bits set in overrideopts must be set in opt to allow it so the change above looks to do what I would expect - though this might not be what others expect it to mean - ie I might well be misunderstanding what AllowOverride ... Options=IncludesNoEXEC should mean.

A heap buffer underwrite flaw was found in apr-util's aprstrmatchprecompile() function.

This flaw could allow a remote attacker to overwrite arbitrary heap memory.

The upstream fix is here: http://svn.apache.org/viewvc?view=rev&revision=779880

Memory leak in the aprbrigadesplitline function in buckets/aprbrigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the modreqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.

The (1) modcache and (2) moddav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.