Bug 1202988 (CVE-2015-0228)

Summary:	CVE-2015-0228 httpd: Possible mod_lua crash due to websocket bug
Product:	[Other] Security Response	Reporter:	Fabio Olive Leite <fleite>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	apatters, cdewolf, ceph-eng-bugs, dajohnso, dandread, darran.lofthouse, dclarizi, dknox, fnasser, gmccullo, huwang, jason.greene, jawilson, jclere, jdoyle, jhardy, jkaluza, jorton, jprause, justinec95, jvlcek, kseifried, lgao, mmaslano, myarboro, obarenbo, pahan, pgier, pslavice, rmeggins, rsvoboda, twalsh, vtunka, webstack-team, weli, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	httpd 2.4.16	Doc Type:	Bug Fix
Doc Text:	A denial of service flaw was found in the way the mod_lua httpd module processed certain WebSocket Ping requests. A remote attacker could send a specially crafted WebSocket Ping packet that would cause the httpd child process to crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-24 19:32:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1232127, 1249799, 1249800
Bug Blocks:	1202992, 1243893

Description Fabio Olive Leite 2015-03-17 20:35:07 UTC

The lua_websocket_read function in lua_request.c in the mod_lua module in
the Apache HTTP Server through 2.4.12 allows remote attackers to cause a
denial of service (child-process crash) by sending a crafted WebSocket Ping
frame after a Lua script has called the wsupgrade function.

Comment 2 Tomas Hoger 2015-03-17 21:21:58 UTC

The affected mod_lua module was introduced upstream in version 2.4:

http://httpd.apache.org/docs/2.4/new_features_2_4.html#newmods

Therefore, this issue did not affect httpd versions as shipped in Red Hat Enterprise Linux 6 and earlier, which include httpd 2.2 or earlier.

Comment 3 Tomas Hoger 2015-03-18 10:05:56 UTC

Upstream commits in trunk and 2.4.x branch:

https://svn.apache.org/viewvc?view=revision&revision=1657261
https://svn.apache.org/viewvc?view=revision&revision=1664118

This is apparently planned to be fixed in not yet released 2.4.13.

Comment 4 Huzaifa S. Sidhpurwala 2015-06-16 06:16:47 UTC

This issue does not affect the version of httpd package as shipped with Red Hat Enterprise Linux 7, because mod_lua in that package does not have WebSocket support.

Comment 5 Huzaifa S. Sidhpurwala 2015-06-16 06:17:54 UTC

Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1232127]

Comment 6 Huzaifa S. Sidhpurwala 2015-06-16 06:22:02 UTC

Statement:

This issue did not affect the version of httpd package as shipped with Red Hat Enterprise Linux 5, 6 and 7.

Comment 7 Fedora Update System 2015-07-21 08:12:26 UTC

httpd-2.4.16-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Tomas Hoger 2015-07-27 12:45:23 UTC

(In reply to Tomas Hoger from comment #3)
> This is apparently planned to be fixed in not yet released 2.4.13.

This was fixed in 2.4.13, but that version, along with version 2.4.14 and 2.4.15 were never released.  The first released version with the fix is 2.4.16.

External References:

http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16

Comment 10 Tomas Hoger 2015-07-27 14:03:22 UTC

(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue does not affect the version of httpd package as shipped with Red
> Hat Enterprise Linux 7, because mod_lua in that package does not have
> WebSocket support.

Upstream security page linked in comment 8 clarifies that the vulnerable code was introduced in upstream version 2.4.7.  The httpd packages in Red Hat Enterprise Linux 7 are based on older upstream version 2.4.6.

Comment 11 Fedora Update System 2015-07-30 00:51:55 UTC

httpd-2.4.16-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 errata-xmlrpc 2015-08-24 15:57:02 UTC

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1666 https://rhn.redhat.com/errata/RHSA-2015-1666.html

Comment 14 Frederik Larsen 2026-06-10 08:50:38 UTC

 if youre into free sex cam shit there is literally a flashing feast of naked tittays rocking anytime u click. you scroll a couple stores across sex live category from bbw extrabw swallowing dragon dildo to skinny emo alt hottie edgeplay private room humping pillow sweat soaked after 2 hours pushin vibe on clit chat paiding out like crazy. couples section has cheating milf and her hubbys 'golf buddy' raw doggin on bed letting chat beat directions and tip spicy shit like jackhammer doggie pausing every thirty pump my idea bro. most babes will tease titties in public xxx chats quick to keep you hooked before draggin ur ass to pay token for proper naked session of complete nude live cam shows in private. seriously swing by and smash that fullscreen on fat ass massage chick oiling her cheeks camera level so u feel drip thru screen. 
https://sexcam.cafe/model/JulliaVegas/
https://livesex.work/model/EdytAlly/
https://livesexcams.fans/model/Vicky_Rico_/
betbow loves it when dudes whalesuhn tokens cuz she turns circular mirror so reflections double the whole live naked girls action making ur corner second cam sync like multi screen spankbank. wanna bust a nut without cash step in during token countdown those sexpots go spread eagle live cam strip and moan liquid nasty filth until zero left tip and you finish clean even with pocket empty.