Date: Tue, 29 May 2007 20:00:42 +0200 (CEST)
From: Blazej Miga <bla@man.poznan.pl.>
To: [email protected]Subject: Apache httpd vulenrabilities
Message-ID: <Pine.GSO.4.64.0705291959110.23746@rose.man.poznan.pl.>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Virus-Scanned: antivirus-gw at tyumen.ru
PSNC Security Team has got the pleasure to announce that, as a result of
Apache httpd server (ver. 1.3.x, 2.0.x and 2.2.x) source code analysis,
several vulnerabilities have been found that make it possible to perfom a
DoS attack against the services and the system that the application is
running on. Below the basic information on found vulnerabilities may be
found:
Vuln#1
Httpd Server DoS
Test environment: ver. 2.0.59, 2.2.4, prefork mpm module
An appropriate code run in the worker process context makes it possible to
kill all worker processes with simultaneous blocking of creating new
worker processes by the master process. As a result, the server stops to
accept and handle new connections.
Vuln #2
SIGUSR1 killer
Test environment: ver. 2.0.59, 2.2.4 prefork mpm module
An appropriate code run in the worker process context makes it possible to
send SIGUSR1 signals by the master process (that runs with root
credentials) to an arbitrary process within the system.
Vuln #3
SIGUSR1 killer
Test environment: ver 1.3.37
An appropriate code run in the worker process context makes it possible to
send SIGUSR1 signals by the master process (that runs with root
credentials) to an arbitrary process within the system.
Vuln #4
System DoS
Test environment: ver 2.0.59, 2.2.4 prefork mpm module
An appropriate code run in the worker process context makes it possible to
force the master process to create an unlimited amount of new worker
processes. As a result, the activity of the whole system may be blocked.
Countermeasures:
Disabling the possibility of running the user.s code in the worker process
context. An especial emphasis should be put on programming languages that
may be configures as an Apache module (like mod_php, mod_perl etc.) in
order to block dangerous functions, e.g. dl(), dlopen().
The information on the vulnerabilities above was sent to Apache Software
Foundation on 16 May, 2006. For over 1 year no official patch has been
issued. PSNC Security Team is currently working on its own, unofficial
patches. Our patches will be published on 18 June, 2007 on the team
webpage (http://security.psnc.pl). On 20 June, 2007 the detailed
information on the found vulnerabilities will be issued.
PSNC Security Team
