Original release date: June 17, 2002<br>
Last revised: November 2, 2007<br>
Source: CERT/CC<br>
<p>A complete revision history can be found at the end of this file.</p>
<br>
<a name="affected"></a>
<h3>Systems Affected</h3>
<ul>
<li>Web servers based on Apache code versions 1.2.2 and above</li>
<li>Web servers based on Apache code versions 1.3 through 1.3.24</li>
<li>Web servers based on Apache code versions 2.0 through 2.0.36</li>
</ul>
<br>
<a name="overview"></a>
<h2>Overview</h2>
<p>There is a remotely exploitable vulnerability in the way that
Apache web servers (or other web servers based on their source code)
handle data encoded in chunks. This vulnerability is present by
default in configurations of Apache web server versions 1.2.2 and
above, 1.3 through 1.3.24, and versions 2.0 through 2.0.36. The
impact of this vulnerability is dependent upon the software version
and the hardware platform the server is running on.</p>
<br>
<a name="description"></a>
<h2>I. Description</h2>
<p>Apache is a popular web server that includes support for
chunk-encoded data according to the HTTP 1.1 standard as described in
<a href="http://www.ietf.org/rfc/rfc2616.txt">RFC2616</a>. There is a
vulnerability in the handling of certain chunk-encoded HTTP requests
that may allow remote attackers to execute arbitrary code.</p>
<p>The Apache Software Foundation has published an advisory describing
the details of this vulnerability. This advisory is available on
their web site at</p>
<blockquote>
<a href="http://httpd.apache.org/info/security_bulletin_20020617.txt">
http://httpd.apache.org/info/security_bulletin_20020617.txt</a>
</blockquote>
<p>Vulnerability Note <a
href="http://www.kb.cert.org/vuls/id/944335">VU#944335</a> includes a
list of vendors that have been contacted about this vulnerability.</p>
<br>
<a name="impact"></a>
<h2>II. Impact</h2>
<p>For Apache versions 1.2.2 through 1.3.24 inclusive, this
vulnerability may allow the execution of arbitrary code by remote
attackers. Exploits are publicly available that claim to allow the
execution of arbitrary code.</p>
<p>For Apache versions 2.0 through 2.0.36 inclusive, the condition
causing the vulnerability is correctly detected and causes the child
process to exit. Depending on a variety of factors, including the
threading model supported by the vulnerable system, this may lead to a
denial-of-service attack against the Apache web server.</p>
<br>
<a name="solution"></a>
<h2>III. Solution</h2>
<h4>Upgrade to the latest version</h4>
<p>The Apache Software Foundation has released two new versions of
Apache that correct this vulnerability. System administrators can
prevent the vulnerability from being exploited by upgrading to Apache
httpd version 1.3.26 or 2.0.39.</p>
<p>Due to some unexpected problems with version 1.3.25, the CERT/CC
has been informed by the Apache Software Foundation that the corrected
version of the software is now 1.3.26. Both 1.3.26 and 2.0.39 are
available on their web site at</p>
<blockquote>
<a href="http://www.apache.org/dist/httpd/">
http://www.apache.org/dist/httpd/</a>
</blockquote>
<h4>Apply a patch from your vendor</h4>
<p>If your vendor has provided a patch to correct this vulnerability,
you may want to apply that patch rather than upgrading your version of
httpd. The CERT/CC is aware of a patch from ISS that corrects some of
the impacts associated with this vulnerability. System administrators
are encouraged to ensure that the patch they apply is based on the
code by the Apache Software Foundation that also corrects additional
impacts described in this advisory.</p>
<p>More information about vendor-specific patches can be found in the
vendor section of this document. Because the publication of this
advisory was unexpectedly accelerated, statements from all of the
affected vendors were not available at publication time. As
additional information from vendors becomes available, this document
will be updated.</p>
<br>
<a name="vendors"></a>
<h2>Appendix A. - Vendor Information</h2>
<p>This appendix contains information provided by vendors for this
advisory. As vendors report new information to the CERT/CC, we will
update this section and note the changes in our revision history. If a
particular vendor is not listed below, we have not received their
comments.</p>
<!-- end vendor -->
<a name="alcatel"></a>
<h4>Alcatel</h4>
<p>In relation to this CERT advisory on security vulnerability in
Apache, Alcatel has conducted an immediate assessment to determine any
impact this may have on our portfolio. A first analysis has shown that
various Alcatel products can be affected: namely the A5000 and A5020
SoftSwitches, the A5735 SMC, the A1300 NMC2, the management platforms
for the A1000 UMTS/GPRS/MSC solutions, the 1353 SH and 1355
VPN. Customers using these products should upgrade to Apache WebServer
1.3.26 (or higher) or may contact their Alcatel support representative
for more details. The security of our customers' networks is of
highest priority for Alcatel. Therefore we continue to test our
product portfolio against potential security vulnerabilities in our
products using the Apache Webserver and will provide updates if
necessary.</p>
<!-- end vendor -->
<a name="apache"></a>
<h4>Apache Software Foundation</h4>
<p>New versions of the Apache software are available from:</p>
<blockquote>
<a href="http://httpd.apache.org/">
http://httpd.apache.org/</a>
</blockquote>
<!-- end vendor -->
<a name="apple"></a>
<h4>Apple Computer, Inc.</h4>
<p>This vulnerability is fixed with the release of the "Security
Update - July 2002" software update.</p>
<!-- end vendor -->
<a name="caldera"></a>
<h4>Caldera</h4>
<p>
Caldera has published several advisories describing this vulnerability:
<blockquote>
<a href="ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt">ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt</a>
<br><br>
<a href="ftp://ftp.caldera.com/pub/security/OpenUNIX/CSSA-2002-SCO.31.txt">ftp://ftp.caldera.com/pub/security/OpenUNIX/CSSA-2002-SCO.31.txt</a>
<br><br>
<a href="ftp://ftp.caldera.com/pub/security/UnixWare/CSSA-2002-SCO.31.txt">ftp://ftp.caldera.com/pub/security/UnixWare/CSSA-2002-SCO.31.txt</a>
<br><br>
<a href="ftp://ftp.caldera.com/pub/security/OpenServer/CSSA-2002-SCO.32.txt">ftp://ftp.caldera.com/pub/security/OpenServer/CSSA-2002-SCO.32.txt</a>
</blockquote>
<!-- end vendor -->
<a name="cisco"></a>
<h4>Cisco Systems</h4>
<p>Cisco Systems is evaluating the vulnerabilities identified by
VU#944335. Should an issue be found, Cisco will release a Security
Advisory. The most up-to-date information on all Cisco product
security issues may be found at</p>
<blockquote>
<a href="http://www.cisco.com/go/psirt/">
http://www.cisco.com/go/psirt/</a>
</blockquote>
<!-- end vendor -->
<a name="compaq"></a>
<h4>Compaq Computer Corporation</h4>
<p>
Compaq has released Security Bulletin <a href="http://wwss1pro.compaq.com/support/reference_library/viewdocument.asp?countrycode=1000&prodid=117|Non-Product+Specific&source=SRB0021W.xml&dt=11">SSRT2253</a> (document number SRB0021W).
</p>
<!-- end vendor -->
<a name="conectiva"></a>
<h4>Conectiva Linux</h4>
<p>The Apache webserver shipped with Conectiva Linux is vulnerable to
this problem. New packages fixing this problem will be announced to
our mailing list after an official fix becomes available.</p>
<!-- end vendor -->
<a name="covalent"></a>
<h4>Covalent</h4>
<p>Covalent Technologies distributes products based on Apache 1.3 and
Apache 2.0 that may be subject to this vulnerability. Covalent is
currently creating patches to affected products. Covalent customers
will be informed by email, and by postings at www.covalent.net/support
when the patches are available.</p>
<!-- end vendor -->
<a name="cray"></a>
<h4>Cray, Inc.</h4>
<p>Cray, Inc. does not distribute Apache with any of its operating
systems.</p>
<!-- end vendor -->
<a name="engarde"></a>
<h4>Engarde</h4>
<p>Guardian Digital ships Apache in all version of EnGarde Secure
Linux. EnGarde Secure Profssional users may update using the GDSN.
This issue was addressed in ESA-20020619-014 which may be found at:</p>
<blockquote>
<a href="http://www.linuxsecurity.com/advisories/other_advisory-2137.html">
http://www.linuxsecurity.com/advisories/other_advisory-2137.html</a>
</blockquote>
</p>
<!-- end vendor -->
<a name="f5"></a>
<h4>F5 Networks</h4>
<p>The following F5 Networks, Inc. products contain a vulnerable version of
the Apache-based web server. Instructions for obtaining and installing a
patch are available in the following locations.</p>
<p><a href="http://tech.f5.com/home/bigip/solutions/security/sol1857.html">
BIG-IP<sup>®</sup> platform</a></p>
<p><a href="http://tech.f5.com/home/3dns/solutions/security/sol1856.html">
3-DNS<sup>®</sup> platform</a></p>
<p><a href="http://tech.f5.com/home/edgefx/solutions/security/sol1853.html">
EDGE-FX<sup>®</sup> platform</a></p>
<p><a href="http://tech.f5.com/home/globalsite/solutions/security/sol1854.html">
GLOBAL-SITE<sup>®</sup> platform</a></p>
<!-- end vendor -->
<a name="fujitsu"></a>
<h4>Fujitsu</h4>
<p>Fujitsu's UXP/V operating system does not support Apache and is
therefore not affected by the vulnerability reported in VU#944335.</p>
<!-- end vendor -->
<a name="hp"></a>
<h4>Hewlett-Packard Company</h4>
<p>
HP makes the Apache Server available for customers as a bundled
software package called "HP Apache." New updates are available
temporarily via ftp from a site located at hprc.external.hp.com.
</p>
<p>
When the new updates are available at www.software.hp.com, the
Hewlett-Packard Company Security Bulletin HPSBUX0207-197 will be
updated.
</p>
<p>
To retrieve the updates from the temporary ftp site, use a browser to
connect to:
<blockquote>
<a href="ftp://apache:apache@192.170.19.51/">ftp://apache:apache@192.170.19.51/</a>
<br><br>
or:
<br><br>
<a href="ftp://apache:apache@hprc.external.hp.com/">ftp://apache:apache@hprc.external.hp.com/</a>
</blockquote>
There are two subdirectories containing depots of swinstallable
binaries with a ".t" extension, one for Apache 2.0.39 (11.00 and
11.11) and one for Apache 1.3.26 (11.00 and 11.11).
</p>
<p>
HP Virtualvault (HP-UX 11.04) patches are available from itrc.hp.com
with ID's of PHSS_27361 and PHSS_27371.
</p>
<p>
For full details, see Hewlett-Packard Company Security Bulletin
HPSBUX0207-197, available on itrc.hp.com. Search for "Apache chunk"
</p>
<!-- end vendor -->
<a name="ibm"></a>
<h4>IBM Corporation</h4>
<p>IBM makes the Apache Server availble for AIX customers as a
software package under the AIX-Linux Affinity initiative. This package
is included on the AIX Toolbox for Linux Applications CD, and can be
downloaded via the IBM Linux Affinity website. The currently available
version of Apache Server is susceptible to the vulnerability described
here. We will update our Apache Server offering shortly to version
1.3.23, including the patch for this vulnerability; this update will
be made available for downloading by accessing this URL:</p>
<blockquote>
<a href="http://www-1.ibm.com/servers/aix/products/aixos/linux/download.html">
http://www-1.ibm.com/servers/aix/products/aixos/linux/download.html</a>
</blockquote>
<p>and following the instructions presented there.</p>
<p>Please note that Apache Server, and all Linux Affinity software, is
offered on an "as-is" basis. IBM does not own the source code for this
software, nor has it developed and fully tested this code. IBM does
not support these software packages.</p>
<p>The IBM HTTP Server product, which is also bundeled with the Websphere
product,is based on the Apache server. As such, it is vulnerable to
the current "Chunk Handling" issue and we are woring on a patch for this
problem with all due haste. This statement will be updated as more
information becomes available.</p>
<p>Information for the Websphere patches is available from the web.
Go to this URL:</p>
<blockquote>
<a href="http://www.ibm.com/software/webservers/appserv/support.html">
http://www.ibm.com/software/webservers/appserv/support.html</a>
</blockquote>
<p>Click on the "Websphere Flashes" link and look for the item for
"IBM HTTP Server". This will contain information on the exposure and
links to the patches.</p>
<p>The IBM HMC product is also affected by the Apache vulnerability
described above. The HMC is the hardware monitor and control console
used with IBM's Regatta systems. This is a seperate hardware unit that
uses a Linux-based operating system and Open Source software.</p>
<p>Customers are advised to obtain the latest security paches for
the HMC. These patches will be available early next week from
the following URL:</p>
<blockquote>
<a href="http://techsupport.services.ibm.com/server/hmc?fetch=corrsrv.html">
http://techsupport.services.ibm.com/server/hmc?fetch=corrsrv.html</a>
</blockquote>
<!-- end vendor -->
<a name="lotus"></a>
<h4>Lotus</h4>
<p>We have verified that the Lotus Domino web server is not vulnerable to
this type of problem. Also, we do not ship Apache code with any Lotus
products.</p>
<!-- end vendor -->
<a name="microsoft"></a>
<h4>Microsoft Corporation</h4>
<p>Microsoft does not ship the Apache web server.</p>
<!-- end vendor -->
<a name="netapp"></a>
<h4>Network Appliance</h4>
<p>Data ONTAP(R) and NetCache(R) products are not affected.</p>
<p>ReplicatorX versions 4.0 through 4.0.21 are affected
(This was originally released by Topio Inc, now a wholly owned subsidiary of
NetApp, as Topio Data Protection Suite (TDPS) releases 1.0 through 3.0.65).</p>
<p>Contact the NetApp Technical Support Center +1-888-4NETAPP for remediation
information and instructions.</p>
<!-- end vendor -->
<a name="nortel"></a>
<h4>Nortel Networks</h4>
<p>Nortel Networks is reviewing its portfolio to determine if any
products are affected by the vulnerability noted in CERT Advisory
CA-2002-17. A definitive statement will be issued shortly.</p>
<!-- end vendor -->
<a name="oracle"></a>
<h4>Oracle</h4>
<p>Oracle has issued Oracle Security Alert #36 in response to the
chunked encoding Apache HTTP Server security vulnerability.</p>
<!-- end vendor -->
<a name="redhat"></a>
<h4>RedHat Inc.</h4>
<p>Red Hat distributes Apache 1.3 versions in all Red Hat Linux
distributions, and as part of Stronghold. However we do not
distribute Apache for Windows. We are currently investigating the
issue and will work on producing errata packages when an official fix
for the problem is made available. When these updates are complete
they will be available from the URL below. At the same time users of
the Red Hat Network will be able to update their systems using the
'up2date' tool.</p>
<blockquote>
<a href="http://rhn.redhat.com/errata/RHSA-2002-103.html">
http://rhn.redhat.com/errata/RHSA-2002-103.html</a>
</blockquote>
<!-- end vendor -->
<a name="securecomputing"></a>
<h4>Secure Computing Corporation</h4>
<p>In response to the CERT Advisory CA-2002-17, Secure Computing has
posted a software patch for users of the SafeWord PremierAccess
version 3.1 authentication system. All existing and new customers are
advised to download and apply PremierAccess Patch 1. Patch
1(v3.1.0.01) is available for immediate web download at</p>
<blockquote>
<a href="http://www.securecomputing.com/index.cfm?skey=1109">http://www.securecomputing.com/index.cfm?skey=1109</a>.
</blockquote>
<!-- end vendor -->
<a name="sgi"></a>
<h4>SGI</h4>
<p>
SGI has released SGI Security Advisory <a href ="ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I">20020605-01-I</a>.
<!-- end vendor -->
<a name="sun"></a>
<h4>Sun Microsystems Inc.</h4>
<p>Sun bundles the Apache Web Server freeware product with Solaris 8
(Apache/1.3.12) and 9 (Apache/1.3.22). Both versions are affected by
this vulnerability. Sun are presently producing patches for this
issue for Solaris 8 and 9. Once the patches are available, we will be
publishing a Sun Alert available from:</p>
<blockquote>
<a href="http://sunsolve.sun.com/">
http://sunsolve.sun.com/</a>
</blockquote>
<!-- end vendor -->
<a name="unisphere"></a>
<h4>Unisphere Networks</h4>
CUSTOMER SERVICE TECHNICAL BULLETIN<br>
SUBJECT: CERT Advisory CA-2002-17: Apache Web Server Chunk Handling Vulnerability<br>
BULLETIN NUMBER: SSC_PSN-001<br>
BULLETIN TYPE: Product Support Notification<br>
AFFECTED PRODUCTS: SSC<br>
ISSUE DATE: 06/26/2002<br>
REVISION: 1.0<br>
<br>
PROBLEM DESCRIPTION:<br>
The CERT Coordination Center released an advisory on June 17, 2002
entitled, "CERT Advisory CA-2002-17 Apache Web Server Chunk Handling
Vulnerability". The URL for the full text of the advisory can be found at:<br>
<blockquote>
<a href="http://www.cert.org/advisories/CA-2002-17.html">
http://www.cert.org/advisories/CA-2002-17.html</a>
</blockquote>
AFFECTED PRODUCT(S):<br>
SSC<br>
<br>
SOLUTION:<br>
The following releases of software have been found to suffer no negative
effects from vulnerability outlined in CERT Advisory CA-2002-17:<br>
<blockquote>
2-0-2p2<br>
2-0-3p2<br>
</blockquote>
All future releases of SSC will include the updated version of Apache web
server that corrects this vulnerability.<br>
<br>
Earlier releases of software may allow the execution of arbitrary code by
remote attackers. Information needed to exploit this vulnerability is
publicly known.<br>
<br>
Affected releases include:<br>
<blockquote>
2-0-0 -- 2-0-2p1<br>
2-0-3 -- 2-0-3p1<br>
</blockquote>
This Product Support Notification is publicly viewable on the Web at:<br>
<blockquote>
<a href="http://support.unispherenetworks.com/websupport/CERT/ssc_psn-001.pdf">
http://support.unispherenetworks.com/websupport/CERT/ssc_psn-001.pdf</a>
</blockquote>
If you have any questions concerning this notice, or to obtain the latest
patch release, please contact Unisphere Networks Customer Service.<br>
<br>
Inside the U.S. call: (800) 424-2344<br>
Outside the U.S. call: (978) 589-9000<br>
Via the Web @ http://support.unispherenetworks.com<br>
Via email @ support@unispherenetworks.com<br>
</blockquote>
<!-- end vendor -->
<a name="trustix"></a>
<h4>Trustix Secure Linux</h4>
<p>
Trustix Secure Linux has published an advisory on this topic:
<blockquote>
<a href="http://www.trustix.net/errata/misc/2002/TSL-2002-0056-apache.asc.txt">http://www.trustix.net/errata/misc/2002/TSL-2002-0056-apache.asc.txt</a>
</blockquote>
</p>
<!-- end vendor -->
<a name="xerox"></a>
<h4>Xerox</h4>
<p>A response to this advisory is available from our web site:
<blockquote>
<a href="http://www.xerox.com/security">http://www.xerox.com/security</a>.
</blockquote>
</p>
<!-- end vendor -->
<hr noshade>
<p>The CERT/CC thanks Mark Litchfield for reporting this vulnerability
to the Apache Software Foundation, and Mark Cox for reporting this
vulnerability to the CERT/CC.</p>
<p></p>
<hr noshade>
<p>Author: <a
href="mailto:cert@cert.org?subject=CA-2002-17%20Feedback%20VU%23944335">Cory
F. Cohen</a>
<p></p>
<!--#include virtual="/include/footer_nocopyright.html" -->
<p>Copyright 2002 Carnegie Mellon University.</p>
<p>Revision History
<pre>
June 17, 2002: Initial release
June 18, 2002: Added Fujitsu vendor statement.
June 18, 2002: Added information about Apache version 1.2.2 and above.
June 18, 2002: Added pointers to Apache versions including 1.3.26.
June 19, 2002: Added Covalent vendor statement.
June 19, 2002: Added Compaq vendor statement.
June 19, 2002: Added Engarde vendor statement.
June 19, 2002: Added SGI vendor statement.
June 19, 2002: Updated Solution section to clarify patch capabilities.
June 19, 2002: Added statement about exploit code for 32-bit platforms.
June 19, 2002: Try to be as clear as possible on the impact (all systems).
June 20, 2002: Added a link to the vulnerability note.
June 20, 2002: Added Hewlett-Packard vendor statement.
June 21, 2002: Added Oracle vendor statement.
June 24, 2002: Added F5 Networks vendor statement.
June 24, 2002: Updated IBM vendor statement to include Websphere information.
June 24, 2002: Added Sun Microsystems Inc. vendor statement.
June 27, 2002: Added Nortel vendor statement.
June 27, 2002: Updated Unisphere vendor statement.
June 28, 2002: Added Alcatel vendor statement.
June 28, 2002: Added Apple vendor statement.
July 08, 2002: Added Cisco vendor statement.
July 15, 2002: Updated Hewlett-Packard vendor statement.
July 15, 2002: Updated SGI vendor statement.
July 15, 2002: Added Caldera vendor statement.
July 15, 2002: Added Trustix vendor statement.
July 16, 2002: Updated Compaq vendor statement.
August 8, 2002: Added Xerox vendor statement.
August 8, 2002: Updated IBM vendor statement.
September 25, 2002: Added Secure Computing vendor statement.
March 27, 2003: Updated Xerox vendor statement.
November 2, 2007: Updated Network Appliance vendor statement.
</pre>
</p>
|