-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SGI Security Advisory
Title: Apache Web Server Chunk Handling vulnerability
Number: 20020605-01-I
Date: July 12, 2002
Reference: SGI Security Advisory 20020605-01-A
Reference: CERT CA-2002-17
Reference: Apache Security Bulletin 20020617
Reference: CAN-2002-0392
______________________________________________________________________________
- -----------------------
- --- Issue Specifics ---
- -----------------------
This bulletin is an update to SGI Security Advisory 20020605-01-A.
It has been reported that versions of the Apache web server up to and
including 1.3.24 and 2.0 up to and including 2.0.36 contain a bug in the
routines which deal with invalid requests which are encoded using chunked
encoding. This bug can be triggered remotely by sending a carefully crafted
invalid request. This functionality is enabled by default.
See http://httpd.apache.org/info/security_bulletin_20020617.txt for
additional details.
SGI has investigated the issues and recommends the following steps for
neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be
implemented on ALL vulnerable SGI systems.
These issues have been corrected in IRIX 6.5.17, where we are now supplying
a fixed version of Apache. We are also making the fixed version of Apache
available on our security FTP site for prior releases of IRIX.
- --------------
- --- Impact ---
- --------------
The Apache webserver is supplied with IRIX versions since 6.5.12m/f as a
replacement for the older SGI FastTrack server. It is installed by default,
and is enabled through "chkconfig" by default.
In order to determine if the Apache webserver is installed, execute the
following command:
# versions -b | grep apache
If the following line is returned you are OK:
I sgi_apache 07/10/2002 SGI Web Server based on Apache, 1.3.26
But if either of these are returned you are vulnerable:
I sgi_apache 03/20/2001 SGI Apache Server, 1.3.17
I sgi_apache 06/10/2001 SGI Apache Server, 1.3.20
I sgi_apache 12/06/2001 SGI Web Server based on Apache, 1.3.22
These vulnerabilities might lead to a root compromise in some
configurations, and no local account is required.
These vulnerabilities have been publicly discussed in Usenet newsgroups
and mailing lists.
This vulnerability was assigned the following CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392
- ----------------------------
- --- Temporary Workaround ---
- ----------------------------
SGI acknowledges that it may not always be possible to immediately install
patches or upgrade the operating system. In those cases, we recommend
removing the Apache webserver and associated products by using the following
commands:
# versions remove sgi_apache\*
# versions remove websetup\*
# versions remove gateway\*
It is not necessary to reboot the system after doing this. You should
upgrade the operating system as soon as it is possible to do so.
- ----------------
- --- Solution ---
- ----------------
SGI has not provided a patch for these issues, but instead has rolled the
fixed Apache distribution into IRIX 6.5.17 and later releases of the
operating system.
OS Version Vulnerable? Patch # Other Actions
---------- ----------- ------- -------------
IRIX 3.x no Note 1
IRIX 4.x no Note 1
IRIX 5.x no Note 1
IRIX 6.0.x no Note 1
IRIX 6.1 no Note 1
IRIX 6.2 no Note 1
IRIX 6.3 no Note 1
IRIX 6.4 no Note 1
IRIX 6.5 no Note 2
IRIX 6.5.1 no Note 2
IRIX 6.5.2 no Note 2
IRIX 6.5.3 no Note 2
IRIX 6.5.4 no Note 2
IRIX 6.5.5 no Note 2
IRIX 6.5.6 no Note 2
IRIX 6.5.7 no Note 2
IRIX 6.5.8 no Note 2
IRIX 6.5.9 no Note 2
IRIX 6.5.10 no Note 2
IRIX 6.5.11 no Note 2
IRIX 6.5.12 yes Note 2
IRIX 6.5.13 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.14 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.15 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.16 yes sgi_apache 1.3.26 Note 2 & 3
IRIX 6.5.17 no
NOTES
1) This version of the IRIX operating has been retired. Upgrade to an
actively supported IRIX operating system. See
http://support.sgi.com/irix/news/index.html#policy for more
information.
2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact your
SGI Support Provider or URL: http://support.sgi.com/irix/swupdates/
3) Install sgi_apache 1.3.26 which is supplied with the IRIX 6.5.17
Applications CD or available as sgi_apache-1.3.26.tar from:
ftp://patches.sgi.com/support/free/security/patches/{6.5.13-6.5.16}
##### Patch File Checksums ####
The actual patch will be a tar file containing the following files:
Filename: sgi_apache
Algorithm #1 (sum -r): 24080 5 sgi_apache
Algorithm #2 (sum): 37968 5 sgi_apache
MD5 checksum: 1EE81B8F7A8DF9ED4D9AF507EA1D2755
Filename: sgi_apache.books
Algorithm #1 (sum -r): 65292 3274 sgi_apache.books
Algorithm #2 (sum): 32822 3274 sgi_apache.books
MD5 checksum: CD6296A58A1B6F1FF2D6B212058D1C4D
Filename: sgi_apache.idb
Algorithm #1 (sum -r): 13477 281 sgi_apache.idb
Algorithm #2 (sum): 4276 281 sgi_apache.idb
MD5 checksum: 3144B64008FF66BF858434208C6BCB5B
Filename: sgi_apache.man
Algorithm #1 (sum -r): 29483 97 sgi_apache.man
Algorithm #2 (sum): 35420 97 sgi_apache.man
MD5 checksum: A7864555852DB7ACC913F049BFC46121
Filename: sgi_apache.src
Algorithm #1 (sum -r): 43010 6244 sgi_apache.src
Algorithm #2 (sum): 58317 6244 sgi_apache.src
MD5 checksum: 7D2A6A9A226327D8D9990F80635AED80
Filename: sgi_apache.sw
Algorithm #1 (sum -r): 20406 1852 sgi_apache.sw
Algorithm #2 (sum): 32509 1852 sgi_apache.sw
MD5 checksum: 371625EE5B321A76137AD1A18B23B4C0
- -------------------
- --- Information ---
- -------------------
SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/
SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/
SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/irix/ and ftp://patches.sgi.com/
SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/
SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/
SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/linux/ or
http://oss.sgi.com/projects/sgilinux-combined/download/security-fixes/
SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/nt/
IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/irix/ and ftp://patches.sgi.com/support/patchset/
IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/colls/patches/tools/relstream/index.html
IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/irix/swupdates/
The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com (216.32.174.211). Security advisories and patches are
located under the URL ftp://patches.sgi.com/support/free/security/
For security and patch management reasons, ftp.sgi.com (mirrors
patches.sgi.com security FTP repository) lags behind and does not do a
real-time update.
- ------------------------
- --- Acknowledgments ----
- ------------------------
SGI wishes to thank Mark Litchfield, CERT, ISS and the users of the Internet
Community at large for their assistance in this matter.
- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------
If there are questions about this document, email can be sent to
security-infoat_private
------oOo------
SGI provides security information and patches for use by the entire SGI
community. This information is freely available to any person needing the
information and is available via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com (216.32.174.211). Security advisories and patches are
located under the URL ftp://patches.sgi.com/support/free/security/
The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/
For issues with the patches on the FTP sites, email can be sent to
security-infoat_private
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email) all
SGI Security Advisories when they are released. Subscribing to the mailing
list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html) or by sending email to
SGI as outlined below.
% mail wiretap-requestat_private
subscribe wiretap <YourEmailAddress>
end
^d
In the example above, <YourEmailAddress> is the email address that you wish
the mailing list information sent to. The word end must be on a separate
line to indicate the end of the body of the message. The control-d (^d) is
used to indicate to the mail program that you are finished composing the
mail message.
------oOo------
SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .
------oOo------
If there are general security questions on SGI systems, email can be sent to
security-infoat_private
For reporting *NEW* SGI security issues, email can be sent to
security-alertat_private or contact your SGI support provider. A support
contract is not required for submitting a security report.
______________________________________________________________________________
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any
way, SGI is appropriately credited and the document retains and
includes its valid PGP signature.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBPS+/UrQ4cFApAP75AQHVJgQApjJG7ZUFT3S/wE7p1khZUiSxBpo1r0qc
inVeNOm1LskJAcr12rVpoKxAvl5UQA1AxeBuDJj1Om5DDN4jHI7mHbTGey4ZdFpJ
6TaewGXadi5xIW75Xh5dFnGYtmRCRSpekSt6VJzVmeYYocmkZyZ/VUjjDo2187Cv
o2LTSqrYsow=
=1pxh
-----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Sat Jul 13 2002 - 11:17:34 PDT