Bug 1202988 (CVE-2015-0228) - CVE-2015-0228 httpd: Possible mod_lua crash due to websocket bug
Summary: CVE-2015-0228 httpd: Possible mod_lua crash due to websocket bug
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-0228
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1232127 1249799 1249800
Blocks: 1202992 1243893
TreeView+ depends on / blocked
 
Reported: 2015-03-17 20:35 UTC by Fabio Olive Leite
Modified: 2021-02-17 05:31 UTC (History)
35 users (show)

Fixed In Version: httpd 2.4.16
Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in the way the mod_lua httpd module processed certain WebSocket Ping requests. A remote attacker could send a specially crafted WebSocket Ping packet that would cause the httpd child process to crash.
Clone Of:
Environment:
Last Closed: 2015-08-24 19:32:30 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1666 0 normal SHIPPED_LIVE Moderate: httpd24-httpd security update 2015-08-24 19:56:41 UTC

Description Fabio Olive Leite 2015-03-17 20:35:07 UTC 
The lua_websocket_read function in lua_request.c in the mod_lua module in
the Apache HTTP Server through 2.4.12 allows remote attackers to cause a
denial of service (child-process crash) by sending a crafted WebSocket Ping
frame after a Lua script has called the wsupgrade function.
Comment 2 Tomas Hoger 2015-03-17 21:21:58 UTC 
The affected mod_lua module was introduced upstream in version 2.4:

http://httpd.apache.org/docs/2.4/new_features_2_4.html#newmods

Therefore, this issue did not affect httpd versions as shipped in Red Hat Enterprise Linux 6 and earlier, which include httpd 2.2 or earlier.
Comment 3 Tomas Hoger 2015-03-18 10:05:56 UTC 
Upstream commits in trunk and 2.4.x branch:

https://svn.apache.org/viewvc?view=revision&revision=1657261
https://svn.apache.org/viewvc?view=revision&revision=1664118

This is apparently planned to be fixed in not yet released 2.4.13.
Comment 4 Huzaifa S. Sidhpurwala 2015-06-16 06:16:47 UTC 
This issue does not affect the version of httpd package as shipped with Red Hat Enterprise Linux 7, because mod_lua in that package does not have WebSocket support.
Comment 5 Huzaifa S. Sidhpurwala 2015-06-16 06:17:54 UTC 
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1232127]
Comment 6 Huzaifa S. Sidhpurwala 2015-06-16 06:22:02 UTC 
Statement:

This issue did not affect the version of httpd package as shipped with Red Hat Enterprise Linux 5, 6 and 7.
Comment 7 Fedora Update System 2015-07-21 08:12:26 UTC 
httpd-2.4.16-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Tomas Hoger 2015-07-27 12:45:23 UTC 
(In reply to Tomas Hoger from comment #3)
> This is apparently planned to be fixed in not yet released 2.4.13.

This was fixed in 2.4.13, but that version, along with version 2.4.14 and 2.4.15 were never released.  The first released version with the fix is 2.4.16.

External References:

http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16
Comment 10 Tomas Hoger 2015-07-27 14:03:22 UTC 
(In reply to Huzaifa S. Sidhpurwala from comment #4)
> This issue does not affect the version of httpd package as shipped with Red
> Hat Enterprise Linux 7, because mod_lua in that package does not have
> WebSocket support.

Upstream security page linked in comment 8 clarifies that the vulnerable code was introduced in upstream version 2.4.7.  The httpd packages in Red Hat Enterprise Linux 7 are based on older upstream version 2.4.6.
Comment 11 Fedora Update System 2015-07-30 00:51:55 UTC 
httpd-2.4.16-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 errata-xmlrpc 2015-08-24 15:57:02 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUS

Via RHSA-2015:1666 https://rhn.redhat.com/errata/RHSA-2015-1666.html
Note You need to log in before you can comment on or make changes to this bug.