Product: mod_ssl - http://www.modssl.org/ Date: 06/24/2002 Summary: Off-by-one in mod_ssl 2.4.9 and earlier By: Frank Denis - jat_private --------------------------------------------------------------------- DESCRIPTION --------------------------------------------------------------------- This module provides strong cryptography for the Apache 1.3 webserver via the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols by the help of the Open Source SSL/TLS toolkit OpenSSL, which is based on SSLeay from Eric A. Young and Tim J. Hudson. The mod_ssl package was created in April 1998 by Ralf S. Engelschall and was originally derived from software developed by Ben Laurie for use in the Apache-SSL HTTP server project. The mod_ssl package is licensed under a BSD-style license, which basically means that you are free to get and use it for commercial and non-commercial purposes. --------------------------------------------------------------------- VULNERABILITY --------------------------------------------------------------------- The Apache web server provides an extended API (EAPI) to easily extended the server with third-party modules, through various hooks called as needed. One of these hooks, rewrite_command, is called right after a configuration directive line was read and before it is processed. mod_ssl registers such a rewrite_command hook when backward compatibility is enabled. The ssl_compat_directive() is called for every line read in a configuration file. However, this function contains an off-by-one error in this code snippet : ... char *cp; char caCmd[1024]; char *cpArgs; ... cp = (char *)oline; for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < 1024; ) ^^^^^^^^ caCmd[i++] = *cp++; caCmd[i] = NUL; cpArgs = cp; ... oline is a pointer to a line being parsed, and whoose content can be arbitrary long, and controlled by untrusted users through ".htaccess" files. --------------------------------------------------------------------- IMPACT --------------------------------------------------------------------- Apart from global configuration files, Apache allows per-directory configuration files. Therefore, the bug can be triggered by any regular user through specially crafted ".htaccess" files. The stack can be smashed. Alexander Yurchenko <grangeat_private> wrote a proof of concept exploit for OpenBSD to demonstrate that arbitrary code could be executed through ".htaccess" files. As noticed by Michal Zalewski <lcamtufat_private>, you can cause an overflow in every child running to force all of them do what you want. This is way more dangerous than children forked for CGI execution. Possible implications include denial of service (by sending STOP signals to every child), adding fake entries to every log file (not only those from the virtualhost the .htaccess lies in), running arbitrary commands as the web server user regardless of ExecCGI and suexec settings and spoofing replies. --------------------------------------------------------------------- VULNERABLE SYSTEMS --------------------------------------------------------------------- Any system running the Apache web server with mod_ssl compiled in, and the "AllowOverride" directive not set to "None" for virtual hosts may be vulnerable if virtual hosts are managed by untrusted users. Systems may be vulnerable even if no virtual host actually use SSL features, as long as mod_ssl is compiled in. Apache 2.0 doesn't seem to ship this part of the mod_ssl source code and it is therefore not vulnerable. mod_ssl compiled without backward compatibility is not vulnerable. However, this feature is enabled by default. --------------------------------------------------------------------- WORKAROUND --------------------------------------------------------------------- Disallow per-directory configuration files by only having "AllowOverride None" directives in your httpd.conf file, and restart the web server. --------------------------------------------------------------------- FIXES --------------------------------------------------------------------- The mod_ssl development team was very reactive and a new version has just been released. mod_ssl 2.8.10 addresses the vulnerability and it is freely available from http://www.modssl.org/ . Upgrading from an earlier release is painless. The bug has also been fixed in OpenBSD-current, thanks to fgsch. The following oneliner patch also addresses the problem : --- pkg.sslmod/ssl_engine_compat.c.orig Sat Feb 23 19:45:23 2002 +++ pkg.sslmod/ssl_engine_compat.c Mon Jun 24 20:43:17 2002 @@ -309,7 +309,7 @@ * Extract directive name */ cp = (char *)oline; - for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < 1024; ) + for (i = 0; *cp != ' ' && *cp != '\t' && *cp != NUL && i < sizeof(caCmd) - 1; ) caCmd[i++] = *cp++; caCmd[i] = NUL; cpArgs = cp; Best regards, -Frank. -- __ /*- Frank DENIS (Jedi/Sector One) <j@42-Networks.Com> -*\ __ \ '/ <a href="http://www.PureFTPd.Org/"> Secure FTP Server </a> \' / \/ <a href="http://www.Jedi.Claranet.Fr/"> Misc. free software </a> \/
This archive was generated by hypermail 2b30 : Wed Jun 26 2002 - 21:11:39 PDT