Apache Web Server MIME Boundary Information Disclosure Vulnerability

Bugtraq ID:	6943
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 25 2003 12:00AM
Updated:	Feb 25 2003 12:00AM
Credit:	This issue was reported by OpenBSD on their errata page.
Vulnerable:	OpenBSD OpenBSD 3.2 Apache Apache 1.3.29 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.2.7 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.2.7 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + OpenPKG OpenPKG 2.0 Apache Apache 1.3.28 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + OpenBSD OpenBSD 3.4 + OpenPKG OpenPKG 1.3 Apache Apache 1.3.27 + HP HP-UX (VVOS) 11.0 4 + HP VirtualVault 4.6 + HP VirtualVault 4.5 + HP Webproxy 2.0 + Immunix Immunix OS 7+ + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + OpenBSD OpenBSD 3.3 + OpenPKG OpenPKG Current + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Linux Advanced Work Station 2.1 + SGI IRIX 6.5.19 Apache Apache 1.3.26 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + OpenPKG OpenPKG 1.1 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 Apache Apache 1.3.25 Apache Apache 1.3.24 + OpenBSD OpenBSD 3.1 + Oracle Oracle HTTP Server 9.2 .0 + Oracle Oracle HTTP Server 9.0.1 + Oracle Oracle9i Application Server 9.0.2 + Oracle Oracle9i Application Server 1.0.2 .2 + Oracle Oracle9i Application Server 1.0.2 .1s + Oracle Oracle9i Application Server 1.0.2 + Slackware Linux 8.1 + Unisphere Networks SDX-300 2.0.3 Apache Apache 1.3.23 - IBM AIX 4.3 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + SuSE Linux 8.0 i386 + SuSE Linux 8.0 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 Apache Apache 1.3.22 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + MandrakeSoft Corporate Server 1.0.1 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + OpenPKG OpenPKG 1.0 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha
Not Vulnerable:

Apache Web Server MIME Boundary Information Disclosure Vulnerability

A vulnerability has been discovered in the Apache web server that may result in the disclosure of sensitive information. Specifically, sensitive process information is used within generated MIME message boundaries.

Access to this information may aid an attacker in launching attacks further attacks against target services.

OpenBSD has released a patch that addresses this issue. MIME boundaries are now generated by the server using BASE64 encoded random numbers.

Apache Web Server MIME Boundary Information Disclosure Vulnerability

No exploit is required.

Apache Web Server MIME Boundary Information Disclosure Vulnerability

Solution:
OpenBSD has released a patch to address this issue.


OpenBSD OpenBSD 3.2

• OpenBSD 008_httpd.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/008_httpd.patch

Apache Web Server MIME Boundary Information Disclosure Vulnerability

References:

• OpenBSD 3.2 release errata & patch list (OpenBSD)