Note: This is an archival copy of Security Sun Alert 228547 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1017443.1.
Solaris 9 Operating System
Solaris 10 Operating System
Solaris 8 Operating System
6204933, 6325738, 6308127
Date of Workaround Release
Date of Resolved Release
1. A vulnerability in the Apache 1.3 web server bundled with Solaris 8 and 9 may allow a local user who is able to create SSI documents which are served by Apache to execute arbitrary code with the privileges of the Apache 1.3 process. The Apache HTTP process normally runs as the unprivileged user "nobody" (uid 60001).
2. A second vulnerability affects the Apache 1.3 web server bundled with Solaris 10 which may prevent certain configured security features from being applied to specific HTTP transactions when Apache is configured to use SSL.
3. A third vulnerability in the Apache 1.3 web server may allow local or remote unprivileged users to bypass security protections associated with some network transactions, corrupt information stored in a web cache, or perform cross site scripting activities when the Apache web server is configured to run as a proxy.
These vulnerabilities are described at the following URLs:
The Change Log for Apache 1.3 at http://www.apache.org/dist/httpd/CHANGES_1.3
CAN-2004-0940: "allows local users[...] to execute arbitrary code" http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940
CAN-2005-2700: "does not properly enforce 'SSLVerifyClient require' " http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
CAN-2005-2088: "HTTP Request Smuggling" http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2088
Issue (1) described above (BugID 6204933) can occur in the following releases:
Issue (2) described above (BugID 6325738) can occur in the following releases:
Issue (3) described above (BugID 6308127) can occur in the following releases:
Note 1: A system is only vulnerable to these issues if the Apache 1.3 web server has been configured and is running on the system. The following command can be executed to check if the Apache(1M) httpd daemon is running on the system:
$ /usr/bin/ps -ef | grep httpd nobody 103892 102307 0 Jan 20 ? 0:27 /usr/apache/bin/httpd
Apache was not bundled with Solaris prior to Solaris 8. However, customers who have built and/or installed a vulnerable version of Apache on any version of Solaris are at risk. See the Apache web site to download the latest version of Apache which addresses these issues.
Note 2: The vulnerability CAN-2004-0940 is present in versions of Apache 1.3 prior to 1.3.33. The vulnerability CAN-2005-2088 is present in versions of Apache 1.3 prior to 1.3.34. The vulnerability CAN-2005-2700 is present when Apache 1.3 is configured to use a version of the 'mod_ssl' module prior to 2.8.24.
To determine the version of the Apache 1.3 web server installed on a host, the following command can be run:
$ /usr/apache/bin/httpd -v Server version: Apache/1.3.33 (Unix) Server built: Jan 22 2006 01:41:39
The version number of the 'mod_ssl' module in use with Apache 1.3 is displayed in the error log when the Apache process starts. For example:
$ grep mod_ssl/ /var/apache/logs/error_log [Fri Feb 17 14:50:48 2006] [notice] Apache/1.3.33 (Unix) mod_perl/1.29 mod_ssl/2.8.22 OpenSSL/0.9.7d configured -- resuming normal operations
Note 3: If no 'mod_ssl' version information is displayed in the log, then the Apache 1.3 web server is not configured to use SSL and is therefore not affected by issue CAN-2005-2700.
Note 4: Apache 2.0 also ships with Solaris 10, which is impacted by some of the issues referenced in this Sun Alert. For details on the impact to Apache 2.0 see Sun Alert 102198.
There are no predictable symptoms that would indicate that issue (1) and (3) described above have been exploited.
If the system is affected by issue (2) described above, some data served by the Apache 1.3 web server may be accessible by clients who are not able to provide the correct credentials.
Until patches are available and can be applied, sites may consider downloading and compiling Apache 1.3.34 or higher from the Apache site:
and mod_ssl 2.8.24 or higher from the modssl site:
as an interim workaround. Note however that the downloaded software is not supported by Sun.
This issue is addressed in the following releases:
For issue (1) described above (BugID 6204933):
For issue (2) described above (BugID 6325738):
For issue (3) described above (BugID 6308127):
This solution has no attachment