Bug 769844 (CVE-2011-3607)

Vincent Danen 2011-11-02 17:14:55 EDT

It was reported [1] that an integer overflow was found in Apache in the
ap_pregsub() function called from mod-setenvif.  When a header field is mangled
using SetEnvIf, the new environment variable data can be multiples of the size
of the submitted header field.  This would cause ap_pregsub() to overflow the
length value in buffer size calculations, leading to the subsequent allocation
call of a too-small buffer.  Filling this buffer with user-supplied data will
lead to a buffer overflow.

Depending on the input data, this can lead to excessive allocation of server
memory (resulting in killed processes due to out-of-memory conditions), invalid
memory access when copying large amounts of data (which can lead to a
termination of the httpd process), or possibly allowing the execution of
arbitrary code.

To trigger this flaw, mod_setenvif must be enabled (the default) and the
attacker needs to be able to place a crafted .htaccess file on the server
(which, in most cases, would require local access to the file system or some
web interface that allows for writing arbitrary files to the local file system,
such as for custom .htaccess files).

There is currently no upstream fix, however to work around the problem, disable
mod_setenvif.

[1] http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/