Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
BID:50494
Info
Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
| Bugtraq ID: | 50494 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2011-3607 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 02 2011 12:00AM |
| Updated: | Apr 13 2015 08:49PM |
| Credit: | halfdog |
| Vulnerable: |
Xerox FreeFlow Print Server (FFPS) 73.C0.41 Xerox FreeFlow Print Server (FFPS) 73.B3.61 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Slackware Linux x86_64 -current Slackware Linux 13.37 x86_64 Slackware Linux 13.37 Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux -current RedHat Enterprise Linux Desktop Workstation 5 client Red Hat JBoss Enterprise Web Server for RHEL 6 1.0 Red Hat JBoss Enterprise Web Server for RHEL 5 Server 1.0 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM HTTP Server 7.0 .11 IBM HTTP Server 7.0.0.5 IBM HTTP Server 7.0.0.19 IBM HTTP Server 7.0.0.17 IBM HTTP Server 7.0.0.15 IBM HTTP Server 7.0.0.13 HP System Management Homepage 7.0 HP System Management Homepage 6.3 HP System Management Homepage 6.2 HP System Management Homepage 6.1 HP System Management Homepage 6.0 HP OpenVMS Secure Web Server 2.2 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 Gentoo Linux Fujitsu INTERSTAGE Studio Standard-J Edition 9.2 Fujitsu INTERSTAGE Studio Standard-J Edition 9.1 Fujitsu INTERSTAGE Studio Standard-J Edition 9.0 Fujitsu INTERSTAGE Studio Standard-J Edition 8.0.1 Fujitsu INTERSTAGE Studio Standard-J Edition 9.1.0 B Fujitsu INTERSTAGE Studio Enterprise Edition 9.1 Fujitsu INTERSTAGE Studio Enterprise Edition 9.0 Fujitsu INTERSTAGE Studio Enterprise Edition 8.0.1 Fujitsu Interstage Business Application Server Enterprise Edition 8.0 Fujitsu INTERSTAGE Apworks Modelers-J Edition 7.0 Fujitsu INTERSTAGE Apworks Modelers-J Edition 6.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.2 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.0.1 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0.1 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.1.0B Fujitsu iNTERSTAGE Application Server Standard Edition 5.0 Fujitsu INTERSTAGE Application Server Plus Developer 5.0.1 Fujitsu INTERSTAGE Application Server Plus Developer 7.0 Fujitsu INTERSTAGE Application Server Plus Developer 6.0 Fujitsu Interstage Application Server Plus 7.0.1 Fujitsu Interstage Application Server Plus 6.0.2 Fujitsu Interstage Application Server Plus 6.0.1 Fujitsu Interstage Application Server Plus 5.0.1 Fujitsu Interstage Application Server Plus 6.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0.3 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 7.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 7.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L11 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L10B Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L10A Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L10 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya IP Office Application Server 8.0 Avaya IP Office Application Server 7.0 Avaya IP Office Application Server 6.1 Avaya IP Office Application Server 6.0 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Session Manager 1.0 Avaya Aura Messaging 6.1 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 Apple Mac Os X Server 10.7.3 Apple Mac Os X Server 10.7.2 Apple Mac Os X Server 10.7.1 Apple Mac Os X Server 10.7 Apple Mac Os X Server 10.6.8 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1 Apache Software Foundation Apache 2.2.15 Apache Software Foundation Apache 2.2.14 Apache Software Foundation Apache 2.2.13 Apache Software Foundation Apache 2.2.12 Apache Software Foundation Apache 2.2.11 Apache Software Foundation Apache 2.2.10 Apache Software Foundation Apache 2.2.9 Apache Software Foundation Apache 2.2.8 Apache Software Foundation Apache 2.2.6 Apache Software Foundation Apache 2.2.5 Apache Software Foundation Apache 2.2.4 Apache Software Foundation Apache 2.2.3 Apache Software Foundation Apache 2.2.2 Apache Software Foundation Apache 2.2 Apache Software Foundation Apache 2.1.9 Apache Software Foundation Apache 2.1.8 Apache Software Foundation Apache 2.1.7 Apache Software Foundation Apache 2.1.6 Apache Software Foundation Apache 2.1.5 Apache Software Foundation Apache 2.1.4 Apache Software Foundation Apache 2.1.3 Apache Software Foundation Apache 2.1.2 Apache Software Foundation Apache 2.1.1 Apache Software Foundation Apache 2.1 Apache Software Foundation Apache 2.0.63 Apache Software Foundation Apache 2.0.61 Apache Software Foundation Apache 2.0.60 Apache Software Foundation Apache 2.0.59 Apache Software Foundation Apache 2.0.58 Apache Software Foundation Apache 2.0.57 Apache Software Foundation Apache 2.0.56 Apache Software Foundation Apache 2.0.55 Apache Software Foundation Apache 2.0.54 Apache Software Foundation Apache 2.0.53 Apache Software Foundation Apache 2.0.52 Apache Software Foundation Apache 2.0.51 Apache Software Foundation Apache 2.0.50 Apache Software Foundation Apache 2.0.49 Apache Software Foundation Apache 2.0.48 Apache Software Foundation Apache 2.0.47 Apache Software Foundation Apache 2.0.46 Apache Software Foundation Apache 2.0.45 Apache Software Foundation Apache 2.0.44 Apache Software Foundation Apache 2.0.43 Apache Software Foundation Apache 2.0.42 Apache Software Foundation Apache 2.0.41 Apache Software Foundation Apache 2.0.40 Apache Software Foundation Apache 2.0.39 Apache Software Foundation Apache 2.0.38 Apache Software Foundation Apache 2.0.37 Apache Software Foundation Apache 2.0.36 Apache Software Foundation Apache 2.0.35 Apache Software Foundation Apache 2.0.34 -BETA Apache Software Foundation Apache 2.0.32 -BETA Apache Software Foundation Apache 2.0.32 Apache Software Foundation Apache 2.0.28 -BETA Apache Software Foundation Apache 2.0.28 Beta Apache Software Foundation Apache 2.0.28 Apache Software Foundation Apache 2.0.9 Apache Software Foundation Apache 2.0 Apache Software Foundation Apache 2.2.21 Apache Software Foundation Apache 2.2.18 Apache Software Foundation Apache 2.2.16 Apache Software Foundation Apache 2.2.1 Apache Software Foundation Apache 2.2 Apache Software Foundation Apache 2.0.64 |
| Not Vulnerable: |
IBM HTTP Server 7.0.0.21 Apache Software Foundation Apache 2.2.22 |
Discussion
Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
Apache HTTP Server is prone to a local privilege-escalation vulnerability because of an integer-overflow error.
Local attackers can exploit this issue to run arbitrary code with elevated privileges (with the privileges of the Apache webserver process). Failed exploit attempts may crash the affected application, denying service to legitimate users.
Note: To trigger this issue, 'mod_setenvif' must be enabled and the attacker should be able to place a malicious '.htaccess' file on the affected webserver.
Apache HTTP Server is prone to a local privilege-escalation vulnerability because of an integer-overflow error.
Local attackers can exploit this issue to run arbitrary code with elevated privileges (with the privileges of the Apache webserver process). Failed exploit attempts may crash the affected application, denying service to legitimate users.
Note: To trigger this issue, 'mod_setenvif' must be enabled and the attacker should be able to place a malicious '.htaccess' file on the affected webserver.
Exploit / POC
Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
An exploit is available. Please see the references for information.
An exploit is available. Please see the references for information.
Solution / Fix
Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
Solution:
Updates are available. Please see the references for more information.
Slackware Linux 12.2
Slackware Linux 13.1
Slackware Linux x86_64 -current
MandrakeSoft Enterprise Server 5
Slackware Linux 13.0 x86_64
Solution:
Updates are available. Please see the references for more information.
Slackware Linux 12.2
-
Slackware apr-util-1.4.1-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ apr-util-1.4.1-i486-1_slack12.2.tgz -
Slackware httpd-2.2.22-i486-1_slack12.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ httpd-2.2.22-i486-1_slack12.2.tgz
Slackware Linux 13.1
-
Slackware apr-util-1.4.1-i486-1_slack13.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ apr-util-1.4.1-i486-1_slack13.1.txz -
Slackware httpd-2.2.22-i486-1_slack13.1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ httpd-2.2.22-i486-1_slack13.1.txz
Slackware Linux x86_64 -current
-
Slackware apr-util-1.4.1-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ l/apr-util-1.4.1-x86_64-1.txz -
Slackware httpd-2.2.22-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ n/httpd-2.2.22-x86_64-1.txz
MandrakeSoft Enterprise Server 5
-
Mandriva apache-base-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-devel-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-htcacheclean-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_authn_dbd-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_cache-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_dav-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_dbd-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_deflate-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_disk_cache-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_file_cache-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_ldap-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_mem_cache-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_proxy-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_proxy_ajp-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_ssl-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mod_userdir-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-modules-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mpm-event-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mpm-itk-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mpm-peruser-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mpm-prefork-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-mpm-worker-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva apache-source-2.2.9-12.15mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/
Slackware Linux 13.0 x86_64
-
Slackware apr-util-1.4.1-x86_64-1_slack13.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/apr-util-1.4.1-x86_64-1_slack13.0.txz -
Slackware httpd-2.2.22-x86_64-1_slack13.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/httpd-2.2.22-x86_64-1_slack13.0.txz
References
Apache HTTP Server 'ap_pregsub()' Function Local Privilege Escalation Vulnerability
References:
References:
- Apache Homepage (Apache Software Foundation)
- Exploit: Integer Overflow in Apache ap_pregsub via mod-setenvif (halfdog)
- Fix list for IBM HTTP Server Version 7.0 (IBM)
- HPSBUX02761 SSRT100823 rev.1 - HP-UX Running Apache, Remote Denial of Service (D (HP)
- Integer Overflow in Apache ap_pregsub via mod-setenvif (halfdog)
- PM50426: Potential buffer overflow and high memory usage in IBM HTTP Server (IBM)
- Wind River Linux apache Security Update (WIND00318514) (Avaya)
- ASA-2012-086 httpd security update (RHSA-2012-0128) (Avaya)
- ASA-2012-127 httpd security update (RHSA-2012-0323) (Avaya)
- ASA-2012-127: httpd security update (RHSA-2012-0323) (Avaya)
- HPSBMU02748 SSRT100772 rev.1 - HP OpenView Network Node Manager (OV NNM) Running (HP)