Note: This is an archival copy of Security Sun Alert 248386 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019892.1.
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
Date of Workaround Release
Date of Resolved Release
Security vulnerability in Solaris related to the Apache 1.3 mod_perl(3) module component "PerlRun.pm" may lead to Denial of Service (DoS):
A security vulnerability in Solaris related to the Apache HTTP server may affect the Apache 1.3 web server bundled with Solaris 8, 9 and 10 . The vulnerability, a Denial of Service(DoS) in the "RunPerl.pm" component of the mod_perl(3) Apache server module, may allow a remote unprivileged user to cause a Denial of Service to the Apache "httpd" process.
Additional information regarding this issue is available at:
2. Contributing Factors
This issue can occur in the following releases:
$ uname -vNote 2: A system is only vulnerable to this issue if the Apache 1.3 web server has been configured and is running on the system.
To determine if the Apache 1.3 web server is running on the system, the following command can be used:
$ /usr/bin/ps -ef | grep "/usr/apache/bin/http"Note 3: This vulnerability only affects systems which make use of the Apache Server mod_perl(3) (PerlRun.pm) component.
To determine if the "PerlRun.pm" component is used, a command such as the following can be run for all configuration files that define the running Apache 1.3 configuration:
$ grep PerlHandler /etc/apache/httpd.conf | grep Apache::PerlRunNote 4: Solaris 8 entered EOSL Phase 2 on 1 April 2009. Entitlement to patches developed on or after 1 April 2009 requires the purchase of the Solaris 8 Vintage Patch Service. See note in section 5 for more details.
If the issue is exploited, the Apache 1.3 web server may be unresponsive, possibly consuming all available CPU resources. Commands such as prstat(1M) can be used to determine the utilization of system resources:
$ prstat -s cpu4. Workaround
To work around the described issue, make sure that the mod_perl(3) (PerlRun.pm) component is not configured in the Apache 1.3 "httpd.conf" file.
This issue is addressed in the following releases:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
22-Apr-2009: Updated Contributing Factors and Resolution sections.
24-Aug-2009: Updated Contributing Factors and Resolution sections. Resolved.
This solution has no attachment