Note: This is an archival copy of Security Sun Alert 228547 as previously published on http://sunsolve.sun.com.
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1017443.1.
Article ID : 1017443.1
Article Type : Sun Alerts (SURE)
Last reviewed : 2006-08-14
Audience : PUBLIC
Copyright Notice: Copyright © 2010, Oracle Corporation and/or its affiliates.

Security Vulnerabilities in the Apache 1.3 Web Server

Category
Security

Release Phase
Resolved

Product
Solaris 9 Operating System
Solaris 10 Operating System
Solaris 8 Operating System

Bug Id
6204933, 6325738, 6308127

Date of Workaround Release
01-MAR-2006

Date of Resolved Release
15-AUG-2006

Impact

1. A vulnerability in the Apache 1.3 web server bundled with Solaris 8 and 9 may allow a local user who is able to create SSI documents which are served by Apache to execute arbitrary code with the privileges of the Apache 1.3 process. The Apache HTTP process normally runs as the unprivileged user "nobody" (uid 60001).

2. A second vulnerability affects the Apache 1.3 web server bundled with Solaris 10 which may prevent certain configured security features from being applied to specific HTTP transactions when Apache is configured to use SSL.

3. A third vulnerability in the Apache 1.3 web server may allow local or remote unprivileged users to bypass security protections associated with some network transactions, corrupt information stored in a web cache, or perform cross site scripting activities when the Apache web server is configured to run as a proxy.

These vulnerabilities are described at the following URLs:

The Change Log for Apache 1.3 at http://www.apache.org/dist/httpd/CHANGES_1.3

CAN-2004-0940: "allows local users[...] to execute arbitrary code" http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940

CAN-2005-2700: "does not properly enforce 'SSLVerifyClient require' " http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700

CAN-2005-2088: "HTTP Request Smuggling" http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2088


Contributing Factors

Issue (1) described above (BugID 6204933) can occur in the following releases:

SPARC Platform

  • Solaris 8 without patch 116973-03
  • Solaris 9 without patch 113146-07

x86 Platform

  • Solaris 8 without patch 116974-03
  • Solaris 9 without patch 114145-06

Issue (2) described above (BugID 6325738) can occur in the following releases:

SPARC Platform

  • Solaris 10 without patch 122911-01

x86 Platform

  • Solaris 10 without patch 122912-01

Issue (3) described above (BugID 6308127) can occur in the following releases:

SPARC Platform

  • Solaris 8 without patch 116973-03
  • Solaris 9 without patch 113146-07
  • Solaris 10 without patch 122911-01

x86 Platform

  • Solaris 8 without patch 116974-03
  • Solaris 9 without patch 114145-06
  • Solaris 10 without patch 122912-01

Note 1: A system is only vulnerable to these issues if the Apache 1.3 web server has been configured and is running on the system. The following command can be executed to check if the Apache(1M) httpd daemon is running on the system:

    $ /usr/bin/ps -ef | grep httpd
    nobody 103892 102307  0   Jan 20 ?      0:27 /usr/apache/bin/httpd

Apache was not bundled with Solaris prior to Solaris 8. However, customers who have built and/or installed a vulnerable version of Apache on any version of Solaris are at risk. See the Apache web site to download the latest version of Apache which addresses these issues.

Note 2: The vulnerability CAN-2004-0940 is present in versions of Apache 1.3 prior to 1.3.33. The vulnerability CAN-2005-2088 is present in versions of Apache 1.3 prior to 1.3.34. The vulnerability CAN-2005-2700 is present when Apache 1.3 is configured to use a version of the 'mod_ssl' module prior to 2.8.24.

To determine the version of the Apache 1.3 web server installed on a host, the following command can be run:

    $ /usr/apache/bin/httpd -v
    Server version: Apache/1.3.33 (Unix)
    Server built:   Jan 22 2006 01:41:39

The version number of the 'mod_ssl' module in use with Apache 1.3 is displayed in the error log when the Apache process starts. For example:

    $ grep mod_ssl/ /var/apache/logs/error_log
    [Fri Feb 17 14:50:48 2006] [notice] Apache/1.3.33 (Unix) mod_perl/1.29
    mod_ssl/2.8.22  OpenSSL/0.9.7d configured -- resuming normal operations

Note 3: If no 'mod_ssl' version information is displayed in the log, then the Apache 1.3 web server is not configured to use SSL and is therefore not affected by issue CAN-2005-2700.

Note 4: Apache 2.0 also ships with Solaris 10, which is impacted by some of the issues referenced in this Sun Alert. For details on the impact to Apache 2.0 see Sun Alert 102198.


Symptoms

There are no predictable symptoms that would indicate that issue (1) and (3) described above have been exploited.

If the system is affected by issue (2) described above, some data served by the Apache 1.3 web server may be accessible by clients who are not able to provide the correct credentials.


Workaround

Until patches are available and can be applied, sites may consider downloading and compiling Apache 1.3.34 or higher from the Apache site:

http://httpd.apache.org

and mod_ssl 2.8.24 or higher from the modssl site:

http://www.modssl.org/

as an interim workaround. Note however that the downloaded software is not supported by Sun.


Resolution

This issue is addressed in the following releases:

For issue (1) described above (BugID 6204933):

SPARC Platform

  • Solaris 8 with patch 116973-03 or later
  • Solaris 9 with patch 113146-07 or later

x86 Platform

  • Solaris 8 with patch 116974-03 or later
  • Solaris 9 with patch 114145-06 or later

For issue (2) described above (BugID 6325738):

SPARC Platform

  • Solaris 10 with patch 122911-01 or later

x86 Platform

  • Solaris 10 with patch 122912-01 or later

For issue (3) described above (BugID 6308127):

SPARC Platform

  • Solaris 8 with patch 116973-03 or later
  • Solaris 9 with patch 113146-07 or later
  • Solaris 10 with patch 122911-01 or later

x86 Platform

  • Solaris 8 with patch 116974-03 or later
  • Solaris 9 with patch 114145-06 or later
  • Solaris 10 with patch 122912-01 or later


Modification History
Date: 07-MAR-2006
  • Updated Contributing Factors

Date: 14-JUN-2006

14-Jun-2006:

  • Updated Contributing Factors and Resolution sections

Date: 13-JUL-2006

13-Jul-2006:

  • Updated Contributing Factors and Resolution sections

Date: 15-AUG-2006

15-Aug-2006:

  • Updated Contributing Factors and Resolution sections
  • State: Resolved


References

113146-07
114145-06
122911-01
122912-01
116973-03
116974-03




Attachments
This solution has no attachment