Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
BID:4189
Info
Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
| Bugtraq ID: | 4189 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 27 2002 12:00AM |
| Updated: | Feb 27 2002 12:00AM |
| Credit: | Credited to Ed Moyle <[email protected]>, Graeme Tait, Apache guru, and Ralf Engelschall. |
| Vulnerable: |
Oracle Oracle9i Standard Edition 9.2 Oracle Oracle9i Standard Edition 9.0.1 Oracle Oracle9i Standard Edition 8.1.7 Oracle Oracle9i Personal Edition 9.2 Oracle Oracle9i Personal Edition 9.0.1 Oracle Oracle9i Personal Edition 8.1.7 Oracle Oracle9i Enterprise Edition 9.2 .0 Oracle Oracle9i Enterprise Edition 9.0.1 Oracle Oracle9i Enterprise Edition 8.1.7 Oracle Oracle9i Application Server 9.0.3 Oracle Oracle9i Application Server 9.0.2 Oracle Oracle9i Application Server 1.0.2 .2 Oracle Oracle9i Application Server 1.0.2 .1s Oracle Oracle HTTP Server 9.2 .0 Oracle Oracle HTTP Server 9.0.1 Oracle Oracle HTTP Server 8.1.7 mod_ssl mod_ssl 2.8.6 mod_ssl mod_ssl 2.8.5 -1 mod_ssl mod_ssl 2.8.5 mod_ssl mod_ssl 2.8.4 mod_ssl mod_ssl 2.8.3 mod_ssl mod_ssl 2.8.2 mod_ssl mod_ssl 2.8.1 -2 mod_ssl mod_ssl 2.8.1 mod_ssl mod_ssl 2.8 mod_ssl mod_ssl 2.7.1 mod_ssl mod_ssl 2.4.10 Apache-SSL Apache-SSL 1.46 Apache-SSL Apache-SSL 1.45 Apache-SSL Apache-SSL 1.44 Apache-SSL Apache-SSL 1.42 Apache-SSL Apache-SSL 1.41 Apache-SSL Apache-SSL 1.40 Apache-SSL Apache-SSL 1.39 |
| Not Vulnerable: |
mod_ssl mod_ssl 2.8.7 mod_ssl mod_ssl 2.8.5 -2 Apache-SSL Apache-SSL 1.47 |
Discussion
Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
Mod_SSL and Apache-SSL are implementations of SSL (Secure Socket Layer) for the Apache webserver.
A buffer overflow vulnerability exists in mod_ssl and Apache-SSL that may allow for attackers to execute arbitrary code. The overflow exists when the modules attempt to cache SSL sessions. Vulnerable versions of mod_ssl and Apache-SSL are incapable of handling large session representations.
To exploit this vulnerability, the attacker must somehow increase the size of the data representing the session. This may be accomplished through the use of an extremely large client certificate. This is only possible if verification of client certificates is enabled, and if the certificate is verified by a CA trusted by the webserver. Though these requirements make this vulnerability theoretical, administrators are still urged to upgrade.
Mod_SSL and Apache-SSL are implementations of SSL (Secure Socket Layer) for the Apache webserver.
A buffer overflow vulnerability exists in mod_ssl and Apache-SSL that may allow for attackers to execute arbitrary code. The overflow exists when the modules attempt to cache SSL sessions. Vulnerable versions of mod_ssl and Apache-SSL are incapable of handling large session representations.
To exploit this vulnerability, the attacker must somehow increase the size of the data representing the session. This may be accomplished through the use of an extremely large client certificate. This is only possible if verification of client certificates is enabled, and if the certificate is verified by a CA trusted by the webserver. Though these requirements make this vulnerability theoretical, administrators are still urged to upgrade.
Exploit / POC
Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
Solution:
mod_ssl is enabled by default in Conectiva Linux Apache packages.
HP Secure OS Software for Linux ships with a customized version of mod_ssl. HP has made a patch available.
Oracle has released an advisory and patches to address this issue. User are advised to obtain patches from the Oracle metalink site listed in references.
Upgrades are available from other vendors:
Apache-SSL Apache-SSL 1.39
Apache-SSL Apache-SSL 1.40
Apache-SSL Apache-SSL 1.41
Apache-SSL Apache-SSL 1.42
Apache-SSL Apache-SSL 1.44
Apache-SSL Apache-SSL 1.45
Apache-SSL Apache-SSL 1.46
mod_ssl mod_ssl 2.4.10
mod_ssl mod_ssl 2.7.1
mod_ssl mod_ssl 2.8
mod_ssl mod_ssl 2.8.1
mod_ssl mod_ssl 2.8.2
mod_ssl mod_ssl 2.8.3
mod_ssl mod_ssl 2.8.4
mod_ssl mod_ssl 2.8.5
mod_ssl mod_ssl 2.8.5 -1
mod_ssl mod_ssl 2.8.6
Solution:
mod_ssl is enabled by default in Conectiva Linux Apache packages.
HP Secure OS Software for Linux ships with a customized version of mod_ssl. HP has made a patch available.
Oracle has released an advisory and patches to address this issue. User are advised to obtain patches from the Oracle metalink site listed in references.
Upgrades are available from other vendors:
Apache-SSL Apache-SSL 1.39
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/ -
Debian apache-ssl_1.3.9.13-4_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/apac he-ssl_1.3.9.13-4_alpha.deb -
Debian apache-ssl_1.3.9.13-4_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/apache -ssl_1.3.9.13-4_arm.deb -
Debian apache-ssl_1.3.9.13-4_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/apach e-ssl_1.3.9.13-4_i386.deb -
Debian apache-ssl_1.3.9.13-4_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/apach e-ssl_1.3.9.13-4_m68k.deb -
Debian apache-ssl_1.3.9.13-4_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ap ache-ssl_1.3.9.13-4_powerpc.deb -
Debian apache-ssl_1.3.9.13-4_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/apac he-ssl_1.3.9.13-4_sparc.deb
Apache-SSL Apache-SSL 1.40
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/
Apache-SSL Apache-SSL 1.41
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/
Apache-SSL Apache-SSL 1.42
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/ -
HP PHSS_26525
Apache-SSL Apache-SSL 1.44
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/
Apache-SSL Apache-SSL 1.45
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/
Apache-SSL Apache-SSL 1.46
-
Apache-SSL apache_1.3.22+ssl_1.47.tar.gz
http://www.apache-ssl.org/
mod_ssl mod_ssl 2.4.10
-
Debian apache-ssl_1.3.9.13-4_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/apac he-ssl_1.3.9.13-4_alpha.deb -
Debian apache-ssl_1.3.9.13-4_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/apache -ssl_1.3.9.13-4_arm.deb -
Debian libapache-mod-ssl-doc_2.4.10-1.3.9-1potato1_all.deb
http://security.debian.org/dists/stable/updates/main/binary-all/libapa che-mod-ssl-doc_2.4.10-1.3.9-1potato1_all.deb -
Debian libapache-mod-ssl_2.4.10-1.3.9-1potato1_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/liba pache-mod-ssl_2.4.10-1.3.9-1potato1_alpha.deb -
Debian libapache-mod-ssl_2.4.10-1.3.9-1potato1_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/libapa che-mod-ssl_2.4.10-1.3.9-1potato1_arm.deb -
Debian libapache-mod-ssl_2.4.10-1.3.9-1potato1_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/libap ache-mod-ssl_2.4.10-1.3.9-1potato1_i386.deb -
Debian libapache-mod-ssl_2.4.10-1.3.9-1potato1_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/libap ache-mod-ssl_2.4.10-1.3.9-1potato1_m68k.deb -
Debian libapache-mod-ssl_2.4.10-1.3.9-1potato1_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/li bapache-mod-ssl_2.4.10-1.3.9-1potato1_powerpc.deb -
Debian libapache-mod-ssl_2.4.10-1.3.9-1potato1_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/liba pache-mod-ssl_2.4.10-1.3.9-1potato1_sparc.deb -
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz
mod_ssl mod_ssl 2.7.1
-
EnGarde Secure Linux apache-1.3.23-1.0.27.i386.rpm
http://ftp.engardelinux.org/pub/engarde/stable/updates/i386/apache-1.3 .23-1.0.27.i386.rpm -
EnGarde Secure Linux apache-1.3.23-1.0.27.i686.rpm
http://ftp.engardelinux.org/pub/engarde/stable/updates/i686/apache-1.3 .23-1.0.27.i686.rpm -
EnGarde Secure Linux apache-1.3.23-1.0.27.src.rpm
Source RPM.
http://ftp.engardelinux.org/pub/engarde/stable/updates/SRPMS/apache-1. 3.23-1.0.27.src.rpm -
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com
mod_ssl mod_ssl 2.8
-
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz -
Trustix apache-1.3.23-1tr.i586.rpm
http://www.trustix.net/pub/Trustix/updates/1.5/RPMS/apache-1.3.23-1tr. i586.rpm -
Trustix apache-1.3.23-1tr.src.rpm
Source RPM.
http://www.trustix.net/pub/Trustix/updates/1.5/SRPMS/apache-1.3.23-1tr .src.rpm -
Trustix apache-devel-1.3.23-1tr.i586.rpm
http://www.trustix.net/pub/Trustix/updates/1.5/RPMS/apache-devel-1.3.2 3-1tr.i586.rpm
mod_ssl mod_ssl 2.8.1
-
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz -
Red Hat secureweb-3.2.5-3.i386.rpm.rhmask
ftp://updates.redhat.com/3.2/other_prod/secureweb/i386/secureweb-3.2.5 -3.i386.rpm.rhmask -
Red Hat secureweb-devel-3.2.5-3.i386.rpm
ftp://updates.redhat.com/3.2/other_prod/secureweb/i386/secureweb-devel -3.2.5-3.i386.rpm -
Red Hat secureweb-manual-3.2.5-3.i386.rpm
ftp://updates.redhat.com/3.2/other_prod/secureweb/i386/secureweb-manua l-3.2.5-3.i386.rpm
mod_ssl mod_ssl 2.8.2
-
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz
mod_ssl mod_ssl 2.8.3
-
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz
mod_ssl mod_ssl 2.8.4
-
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
Mandrake mod_ssl-2.8.4-4.2mdk.i586.rpm
Single Network Firewall 7.2.
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz
mod_ssl mod_ssl 2.8.5
-
Conectiva apache-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-1.3.22-1U50_3cl.i3 86.rpm -
Conectiva apache-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache- 1.3.22-1U50_3cl.i386.rpm -
Conectiva apache-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-1 .3.22-1U50_3cl.i386.rpm -
Conectiva apache-1.3.22-1U51_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-1.3.22-1U51_3cl.i3 86.rpm -
Conectiva apache-1.3.22-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.22-1U60_3cl.i3 86.rpm -
Conectiva apache-1.3.22-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.22-1U70_3cl.i3 86.rpm -
Conectiva apache-devel-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-devel-1.3.22-1U50_ 3cl.i386.rpm -
Conectiva apache-devel-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache- devel-1.3.22-1U50_3cl.i386.rpm -
Conectiva apache-devel-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-d evel-1.3.22-1U50_3cl.i386.rpm -
Conectiva apache-devel-1.3.22-1U51_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-devel-1.3.22-1U51_ 3cl.i386.rpm -
Conectiva apache-devel-1.3.22-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.22-1U60_ 3cl.i386.rpm -
Conectiva apache-devel-1.3.22-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.22-1U70_ 3cl.i386.rpm -
Conectiva apache-doc-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.0/i386/apache-doc-1.3.22-1U50_3c l.i386.rpm -
Conectiva apache-doc-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/apache- doc-1.3.22-1U50_3cl.i386.rpm -
Conectiva apache-doc-1.3.22-1U50_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/apache-d oc-1.3.22-1U50_3cl.i386.rpm -
Conectiva apache-doc-1.3.22-1U51_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/5.1/i386/apache-doc-1.3.22-1U51_3c l.i386.rpm -
Conectiva apache-doc-1.3.22-1U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.22-1U60_3c l.i386.rpm -
Conectiva apache-doc-1.3.22-1U70_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.22-1U70_3c l.i386.rpm -
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
Mandrake mod_ssl-2.8.5-2.1mdk.i586.rpm
Mandrake 8.1.
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.5-2.1mdk.ia64.rpm
Mandrake 8.1 ia64.
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.5-2.2mdk.i586.rpm
Mandrake 8.0.
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.5-2.2mdk.ppc.rpm
Mandrake 8.0 PPC.
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.5-2.3mdk.i586.rpm
Mandrake 7.2.
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.5-2.4mdk.i586.rpm
Corporate Server 1.0.1.
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.5-2.4mdk.i586.rpm
Mandrake 7.1.
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz -
Red Hat mod_ssl-2.8.5-3.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/mod_ssl-2.8.5-3.alpha.rpm -
Red Hat mod_ssl-2.8.5-3.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/mod_ssl-2.8.5-3.alpha.rpm -
Red Hat mod_ssl-2.8.5-3.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/mod_ssl-2.8.5-3.i386.rpm -
Red Hat mod_ssl-2.8.5-3.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/mod_ssl-2.8.5-3.i386.rpm -
Red Hat mod_ssl-2.8.5-3.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/mod_ssl-2.8.5-3.ia64.rpm -
Red Hat mod_ssl-2.8.5-4.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mod_ssl-2.8.5-4.i386.rpm -
Red Hat mod_ssl-2.8.5-4.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/mod_ssl-2.8.5-4.ia64.rpm
mod_ssl mod_ssl 2.8.5 -1
-
Caldera mod_ssl-2.8.5_1.3.22-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS/ mod_ssl-2.8.5_1.3.22-2.i386.rpm -
Caldera mod_ssl-2.8.5_1.3.22-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/ RPMS/mod_ssl-2.8.5_1.3.22-2.i386.rpm -
Caldera mod_ssl-2.8.5_1.3.22-2.src.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS /mod_ssl-2.8.5_1.3.22-2.src.rpm -
Caldera mod_ssl-2.8.5_1.3.22-2.src.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/ SRPMS/mod_ssl-2.8.5_1.3.22-2.src.rpm -
Caldera mod_ssl-sxnet-2.8.5_1.3.22-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS/ mod_ssl-sxnet-2.8.5_1.3.22-2.i386.rpm -
Caldera mod_ssl-sxnet-2.8.5_1.3.22-2.i386.rpm
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/ RPMS/mod_ssl-sxnet-2.8.5_1.3.22-2.i386.rpm
mod_ssl mod_ssl 2.8.6
-
Compaq CSWS101_UPDATE V1.0
CSWS V1.0-1
http://www.openvms.compaq.com/openvms/products/ips/apache/csws_patches .html -
Compaq CSWS111_UPDATE V1.0
CSWS V1.1-1
http://www.openvms.compaq.com/openvms/products/ips/apache/csws_patches .html -
Compaq CSWS12_UPDATE V1.0
CSWS V1.2
http://www.openvms.compaq.com/openvms/products/ips/apache/csws_patches .html -
HP HPTL_00012
Fix for HP Secure OS Software for Linux 1.0.1.
http://itrc.hp.com -
mod_ssl mod_ssl-2.8.7-1.3.23.tar.gz
Mod_SSL version 2.8.7 for Apache 1.3.23.
http://www.modssl.org/source/mod_ssl-2.8.7-1.3.23.tar.gz
References
Apache mod_ssl/Apache-SSL Buffer Overflow Vulnerability
References:
References:
- Apache-SSL buffer overflow condition (all versions prior to 1.3.22+1.46) (Apache-SSL)
- Apache-SSL Homepage (Apache-SSL)
- mod_ssl Homepage (mod_ssl Project)
- Oracle Support Metalink (Oracle)
- SSL Update for CERT CA200326 and older SSL issues (Oracle)