modules/arch/win32/modisapi.c in modisapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapiunload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."

DISPUTED Unspecified vulnerability in modproxybalancer for Apache HTTP Server 2.2.x before 2.2.7-dev, when running on Windows, allows remote attackers to trigger memory corruption via a long URL. NOTE: the vendor could not reproduce this issue.

Martin Joey Schulze discovered a flaw in the way modauthmysql handles certain multibyte character encodings.

If modauthmysql is configured to use use a multibyte character set that allows the backslash '\' character as part of the character encodings, it is possible to inject arbitrary SQL commands to the MySQL database server.

An Uncontrolled Resource Consumption vulnerability in multiple products may allow an attacker to cause web service portal denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly. Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests in pieces slowly, one at a time to a Web server. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data. When the server’s concurrent connection pool reaches its maximum, this creates a DoS. Slow HTTP attacks are easy to execute because they require only minimal resources from the attacker.

Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).

RMDG partner and independent security consultancy, "Context Information Security" has made CPNI Response aware of a security vulnerability which could potentially allow an attacker to gain full internal access to a network from the internet.

The technique exploits insecurely configured reverse web proxies to gain access to internal/DMZ systems.

This attack is based on an Apache web server which is using "modrewrite" to proxy web requests internally. Other proxies may suffer from this issue.

The vulnerability occurs if the Apache configuration file is configured like this:

RewriteRule ^(.) http://internalserver:80$1 [P]

As opposed to:

RewriteRule ^(.) http://internalserver:80/$1 [P]

It is important for readers to review their reverse proxy configurations to ensure that the rewrite rules are securely configured and cannot be abused in such a way that they can be used to compromise internal systems.

Martin Holst Swende discovered a flaw in the way modheaders handled chunked requests. A remote attacker could use this flaw to bypass intended modheaders restrictions, allowing them to send requests to applications that include headers that should have been removed by modheaders.

Discussion and a possible patch is available from the following thread:

http://marc.info/?t=138219209900002&r=1&w=2

References:

http://martin.swende.se/blog/HTTPChunked.html

The following flaw has been fixed in the Apache HTTP Server:

"A flaw was found in modcgid. If a server using modcgid hosted CGI scripts which did not consume standard input, a remote attacker could cause child processes to hang indefinitely, leading to denial of service."

External References:

http://httpd.apache.org/security/vulnerabilities24.html

Quoting httpd 2.2 security page: http://httpd.apache.org/security/vulnerabilities22.html#2.2.15

moderate: modproxyajp DoS CVE-2010-0408

modproxyajp would return the wrong status code if it encountered an error causing a backend server to be put into an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in a denial of service.

Affects: 2.2.0 - 2.2.14

Upstream commit: http://svn.apache.org/viewvc?view=revision&revision=917876

The (1) modcache and (2) moddav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.

Description of problem:

In an httpd.conf fragment like:

<Directory ...somepath...> AllowOverride ... Options=IncludesNoEXEC </Directory>

that appears to limit what Options can be set in .htaccess to just IncludeNoexec, but in fact Options Includes is also allowed. I assume that this is an upstream bug but I've not checked if any RH patches touch this part of the code.

Version-Release number of selected component (if applicable):

httpd-2.2.3-22.el5

How reproducible:

100%

Steps to Reproduce: 1. Add a <directory> which permits AllowOverride Options=IncludesNoEXEC 2. create a .htaccess in there and use Options Includes 3. access a file using ssi with #exec Actual results:

the #exec is executed

Expected results:

includesnoexec only should be allowed ie no exec or cgi.

Additional info:

In the httpd source (as patched by the srpm etc), in server/core.c at about line 1288 we have the definition of setallowopts() which contains:

... else if (!strcasecmp(w, "Includes")) { opt = OPTINCLUDES; } else if (!strcasecmp(w, "IncludesNOEXEC")) { opt = (OPTINCLUDES | OPTINCNOEXEC); } ...

I think that should probably be:

... else if (!strcasecmp(w, "Includes")) { opt = (OPTINCLUDES | OPTINCNOEXEC); } else if (!strcasecmp(w, "IncludesNOEXEC")) { opt = OPTINCNOEXEC; } ...

since there is (as far as I can see) no harm allowing the user to specify IncludesNoExec if you allow them to use Includes but not the other way round.

Of course my understanding of the logic in setoptions() might well be flawed but it seems that at least one of the bits set in overrideopts must be set in opt to allow it so the change above looks to do what I would expect - though this might not be what others expect it to mean - ie I might well be misunderstanding what AllowOverride ... Options=IncludesNoEXEC should mean.

Integer overflow in the appregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the modsetenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

SUSE reported that upstream patch for CVE-2011-3368 (bug #740045), when applied to httpd versions before 2.2.18, does not completely address the issue, when attacker sends HTTP 0.9 requests::

https://bugzilla.novell.com/showbug.cgi?id=722545#c15 http://thread.gmane.org/gmane.comp.apache.devel/45978 http://thread.gmane.org/gmane.comp.security.oss.general/6102

The fix has been created upstream and committed to trunk:

http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45979 http://svn.apache.org/viewvc?view=revision&revision=1188745

Upstream also confirmed this additional fix is not required for httpd versions 2.2.18 and later:

http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45983 http://thread.gmane.org/gmane.comp.apache.devel/45978/focus=45985

Additional problems were discovered in the httpd fix for CVE-2011-3368 - a reverse proxy bypass flaw - tracked via bug #740045. Upstream mailing list post identifies following request forms, which are not handled correctly:

GET @localhost::8880 HTTP/1.0\r\n\r\n GET qualys:@qqq.qq.qualys.com HTTP/1.0\r\n\r\n

Reference: http://thread.gmane.org/gmane.comp.apache.devel/46440

Cross-site scripting (XSS) vulnerability in proxyftp.c in the modproxyftp module in Apache 2.0.63 and earlier, and modproxyftp.c in the modproxyftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.

Apache HTTP Server, when running on Linux with a document root on a Windows share mounted using smbfs, allows remote attackers to obtain unprocessed content such as source files for .php programs via a trailing "\" (backslash), which is not handled by the intended AddType directive.

Cross-site scripting (XSS) vulnerability in modstatus in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Cross-site request forgery (CSRF) vulnerability in the balancer-manager in modproxybalancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.

Cross-site scripting (XSS) vulnerability in the (1) modimap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) modimagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-4558 tothe following vulnerability:

Name: CVE-2012-4558 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558 Assigned: 20120821 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxybalancer.c?r1=1404653&r2=1413732&diffformat=h

Multiple cross-site scripting (XSS) vulnerabilities in the balancerhandler function in the manager interface in modproxybalancer.c in the modproxybalancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3499 to the following vulnerability:

Name: CVE-2012-3499 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 Assigned: 20120614 Reference: http://httpd.apache.org/security/vulnerabilities22.html Reference: http://httpd.apache.org/security/vulnerabilities24.html Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modinfo.c?r1=1225799&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/modstatus.c?r1=1389564&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ldap/utilldapcachemgr.c?r1=1209766&r2=1418752&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/mappers/modimagemap.c?r1=1398480&r2=1413732&diffformat=h Reference: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/modproxyftp.c?r1=1404625&r2=1413732&diffformat=h

Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) modimagemap, (2) modinfo, (3) modldap, (4) modproxyftp, and (5) modstatus modules.

The balancerhandler function in modproxybalancer in the Apache HTTP Server 2.2.0 through 2.2.6, when a threaded Multi-Processing Module is used, allows remote authenticated users to cause a denial of service (child process crash) via an invalid bb variable.

Cross-site scripting (XSS) vulnerability in balancer-manager in modproxybalancer in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) ss, (2) wr, or (3) rr parameters, or (4) the URL.

Multiple cross-site scripting (XSS) vulnerabilities in the makevariantlist function in modnegotiation.c in the modnegotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

It was reported [1] that an integer overflow was found in Apache in the appregsub() function called from mod-setenvif. When a header field is mangled using SetEnvIf, the new environment variable data can be multiples of the size of the submitted header field. This would cause appregsub() to overflow the length value in buffer size calculations, leading to the subsequent allocation call of a too-small buffer. Filling this buffer with user-supplied data will lead to a buffer overflow.

Depending on the input data, this can lead to excessive allocation of server memory (resulting in killed processes due to out-of-memory conditions), invalid memory access when copying large amounts of data (which can lead to a termination of the httpd process), or possibly allowing the execution of arbitrary code.

To trigger this flaw, modsetenvif must be enabled (the default) and the attacker needs to be able to place a crafted .htaccess file on the server (which, in most cases, would require local access to the file system or some web interface that allows for writing arbitrary files to the local file system, such as for custom .htaccess files).

There is currently no upstream fix, however to work around the problem, disable modsetenvif.

[1] http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/