Bugzilla Bug 68564

http://www.apacheweek.com/features/security-13

Fixed in Apache httpd 1.3.33-dev

    moderate: mod_include overflow CAN-2004-0940

    A buffer overflow in mod_include could allow a local user who is authorised to create server side include (SSI) files to gain the privileges of a httpd child.
    Affects: 1.3.32, 1.3.31, 1.3.29, 1.3.28, 1.3.27, 1.3.26, 1.3.24, 1.3.22, 1.3.20, 1.3.19, 1.3.17, 1.3.14, 1.3.12, 1.3.11, 1.3.9, 1.3.6, 1.3.4, 1.3.3, 1.3.2, 1.3.1, 1.3.0

_____
http://secunia.com/advisories/12898/

Secunia Advisory:	SA12898
Release Date:	2004-10-22

Critical:	
Less critical
Impact:	Privilege escalation
Where:	Local system
Solution Status:	Vendor Patch

Software:	Apache 1.3.x

CVE reference:	CAN-2004-0940

Description:
Crazy Einstein has discovered a vulnerability in Apache, which can be exploited by malicious, local users to gain escalated privileges.

The vulnerability is caused due to a boundary error in the "get_tag()" function of the "mod_include" module. This can be exploited to cause a buffer overflow when a specially crafted document with malformed server-side includes is requested through a HTTP session.

Successful exploitation can lead to execution of arbitrary code with escalated privileges, but requires that server-side includes (SSI) is enabled.

The vulnerability has been confirmed on version 1.3.31. Other versions may also be affected.

Solution:
The vulnerability has been fixed in version 1.3.33-dev.

Disable server-side includes (SSI).

Provided and/or discovered by:
Crazy Einstein

_____
http://securitytracker.com/alerts/2004/Oct/1011783.html

SecurityTracker Alert ID:  1011783
SecurityTracker URL:  http://securitytracker.com/id?1011783
CVE Reference:  GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 19 2004
Impact:  Execution of arbitrary code via local system, User access via local system
Exploit Included:  Yes  
Version(s): 1.3.x
Description:  Crazy Einstein reported a buffer overflow in Apache mod_include. A local user may be able to gain elevated privileges.

It is reported that the get_tag() function contains a buffer overflow that can be triggered, for example, from the handle_echo() function. A local user can create specially crafted HTML that, when processed by Apache, will execute arbitrary code with the privileges of the httpd child process.
Impact:  A local user can execute arbitrary code with the privileges of the Apache httpd child process.
Solution:  No solution was available at the time of this entry.
Vendor URL:  httpd.apache.org/ (Links to External Site)
Cause:  Boundary error
Underlying OS:  Linux (Any), UNIX (Any)
Reported By:  Crazy Einstein <crazy_einstein@yahoo.com>

apache team, pls review/patch as appropriate

commited as 1.3.32-r1

thx stuart and tigger

arches, pls test apache-1.3.32-r1 and mark stable if possible

current KEYWORDS="~x86 ~ppc ~sparc ~alpha ~hppa ~amd64 ~ia64 ~mips"
target KEYWORDS="x86 ppc sparc alpha hppa amd64 ia64 mips"

Stable on amd64

Stable on sparc

stable on ppc

Stable on alpha.

Could apache maintainers or someone on x86 test and mark x86 stable ?

FYI,

Apache-1.3.33 is now in the tree.  Upstream haven't released a corresponding mod_ssl yet, however, so this ebuild is masked for the moment.

At this rate of Apache releases, we should start thinking about a dedicated apache security & arch test group ;-)

Best regards,
Stu

arches, mod_ssl-2.8.21 is also needed to be marked stable

current KEYWORDS="x86 ~ppc ~sparc ~alpha ~hppa ~mips"
target KEYWORDS="x86 ppc sparc alpha hppa mips"

Stable on sparc.

Stable on ppc.

Stable on alpha.

mod_ssl-2.8.21 still missing amd64 to test and mark stable
otherwise ready for GLSA

stable on amd64

GLSA 200411-03

hppa, ia64 and mips, please mark stable to benefit from GLSA

mips stable.