Apache Portable Runtime (APR): Unexpected lax shared memory permissions

Severity: moderate

Affected versions:

- Apache Portable Runtime (APR) 0.9.0 through 1.7.4

Description:

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Credit:

Thomas Stangner (reporter)

References:

https://apr.apache.org/ https://www.cve.org/CVERecord?id=CVE-2023-49582

Timeline:

2023-02-08: Discussion on public mailing list https://lists.apache.org/thread/h5f1c2dqm8bf5yfosw3rg85927p612l0 2023-11-15: Reported to security team

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in aprsocketsendv(). This is a result of integer overflow.

https://lists.apache.org/thread/5pfdfn7h0vsdo5xzjn97vghp0x42jj2r

Integer Overflow or Wraparound vulnerability in aprencode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9

Apache Portable Runtime (APR) could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the aprsocketsendv() function. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

Integer Overflow or Wraparound vulnerability in aprencode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.

A flaw was found in the Apache Portable Runtime Utility (APR-util) library. This issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions.

An out-of-bounds array read in the aprtimeexp() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.

APR. Multiple issues in Perl were addressed with improved memory handling.

Apache APR is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending multiple specially-crafted HTTP POST requests to an affected application containing conflicting hash key values, a remote attacker could exploit this vulnerability to cause the consumption of CPU resources.

Apache Portable Runtime (APR) is vulnerable to a denial of service, caused by an error in the aprfnmatch() function when processing specific patterns with the "" wildcard. A remote attacker could exploit this vulnerability to consume all available CPU and memory resources resulting in a denial of service.

The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocatoralloc or (2) aprpalloc function in memory/unix/aprpools.c in APR; or crafted calls to the (3) aprrmmmalloc, (4) aprrmmcalloc, or (5) aprrmmrealloc function in misc/aprrmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.