Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability

Bugtraq ID:	59826
Class:	Input Validation Error
CVE:	CVE-2013-1862
Remote:	Yes
Local:	No
Published:	May 13 2013 12:00AM
Updated:	Jul 15 2015 12:34AM
Credit:	Ramiro Molina
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise Server 10 SP3 LTSS SuSE openSUSE 11.4 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM Websphere Application Server 8.0 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.1 IBM HTTP Server 8.0.0.1 IBM HTTP Server 8.0 HP HP-UX B.11.31 Gentoo Linux Fujitsu INTERSTAGE Studio Standard-J Edition 9.2 Fujitsu INTERSTAGE Studio Standard-J Edition 9.1 Fujitsu INTERSTAGE Studio Standard-J Edition 9.0 Fujitsu INTERSTAGE Studio Standard-J Edition 8.0.1 Fujitsu INTERSTAGE Studio Standard-J Edition 9.1.0 B Fujitsu INTERSTAGE Studio Enterprise Edition 9.1 Fujitsu INTERSTAGE Studio Enterprise Edition 9.0 Fujitsu INTERSTAGE Studio Enterprise Edition 8.0.1 Fujitsu Interstage Business Application Server Enterprise Edition 8.0 Fujitsu INTERSTAGE Apworks Modelers-J Edition 7.0 Fujitsu INTERSTAGE Apworks Modelers-J Edition 6.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.2 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.0.1 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0.1 Fujitsu INTERSTAGE Application Server Standard-J Edition 8.0 Fujitsu INTERSTAGE Application Server Standard-J Edition 9.1.0B Fujitsu iNTERSTAGE Application Server Standard Edition 5.0 Fujitsu INTERSTAGE Application Server Plus Developer 5.0.1 Fujitsu INTERSTAGE Application Server Plus Developer 7.0 Fujitsu INTERSTAGE Application Server Plus Developer 6.0 Fujitsu Interstage Application Server Plus 7.0.1 Fujitsu Interstage Application Server Plus 6.0.2 Fujitsu Interstage Application Server Plus 6.0.1 Fujitsu Interstage Application Server Plus 5.0.1 Fujitsu Interstage Application Server Plus 6.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 9.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0.3 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 8.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 7.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0.2 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0.1 Fujitsu INTERSTAGE Application Server Enterprise Edition 7.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 6.0 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L11 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L10B Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L10A Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 L10 Fujitsu INTERSTAGE Application Server Enterprise Edition 5.0 CentOS CentOS 5 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 Avaya Meeting Exchange 6.0 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Session Manager 1.0 Avaya Aura Messaging 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Messaging 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 Apache Software Foundation Apache 2.2.15 Apache Software Foundation Apache 2.2.14 Apache Software Foundation Apache 2.2.13 Apache Software Foundation Apache 2.2.12 Apache Software Foundation Apache 2.2.11 Apache Software Foundation Apache 2.2.10 Apache Software Foundation Apache 2.2.9 Apache Software Foundation Apache 2.2.8 Apache Software Foundation Apache 2.2.6 Apache Software Foundation Apache 2.2.5 Apache Software Foundation Apache 2.2.4 Apache Software Foundation Apache 2.2.3 Apache Software Foundation Apache 2.2.2 Apache Software Foundation Apache 2.2 Apache Software Foundation Apache 2.0.63 Apache Software Foundation Apache 2.0.61 Apache Software Foundation Apache 2.0.60 Apache Software Foundation Apache 2.0.59 Apache Software Foundation Apache 2.0.58 Apache Software Foundation Apache 2.0.57 Apache Software Foundation Apache 2.0.56 Apache Software Foundation Apache 2.0.55 Apache Software Foundation Apache 2.0.54 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Apache Software Foundation Apache 2.0.53 Apache Software Foundation Apache 2.0.52 Apache Software Foundation Apache 2.0.51 Apache Software Foundation Apache 2.0.50 Apache Software Foundation Apache 2.0.49 Apache Software Foundation Apache 2.0.48 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux 8.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Apache Software Foundation Apache 2.0.47 Apache Software Foundation Apache 2.0.46 Apache Software Foundation Apache 2.0.45 Apache Software Foundation Apache 2.0.44 Apache Software Foundation Apache 2.0.43 Apache Software Foundation Apache 2.0.42 Apache Software Foundation Apache 2.0.41 Apache Software Foundation Apache 2.0.40 + RedHat Linux 9.0 i386 + RedHat Linux 8.0 + Terra Soft Solutions Yellow Dog Linux 3.0 Apache Software Foundation Apache 2.0.39 Apache Software Foundation Apache 2.0.38 Apache Software Foundation Apache 2.0.37 Apache Software Foundation Apache 2.0.36 Apache Software Foundation Apache 2.0.35 Apache Software Foundation Apache 2.0.32 Apache Software Foundation Apache 2.2.22 Apache Software Foundation Apache 2.2.21 Apache Software Foundation Apache 2.2.21 Apache Software Foundation Apache 2.2.20 Apache Software Foundation Apache 2.2.19 Apache Software Foundation Apache 2.2.18 Apache Software Foundation Apache 2.2.17 Apache Software Foundation Apache 2.2.16 Apache Software Foundation Apache 2.2.1 Apache Software Foundation Apache 2.2 Apache Software Foundation Apache 2.0.64
Not Vulnerable:

Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability

Apache HTTP Server is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary commands in the context of the application.

Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability

An attacker can exploit this issue using readily available tools.

Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


MandrakeSoft Enterprise Server 5

• Mandriva apache-base-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-devel-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-doc-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-htcacheclean-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_authn_dbd-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_cache-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_dav-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_dbd-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_deflate-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_disk_cache-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_file_cache-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_ldap-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_mem_cache-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_proxy-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_proxy_ajp-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_proxy_scgi-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_reqtimeout-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_ssl-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mod_userdir-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-modules-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mpm-event-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mpm-itk-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mpm-peruser-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mpm-prefork-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-mpm-worker-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva apache-source-2.2.24-0.2mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Apache HTTP Server Terminal Escape Sequence in Logs Command Injection Vulnerability

References:

• Apache Homepage (Apache Software Foundation)