Bug 521619 (CVE-2009-3094) - CVE-2009-3094 httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply
Summary: CVE-2009-3094 httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EP...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-3094
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 523830 534038 534039 534040 534041 534042 534086 534088 538228
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-07 09:55 UTC by Tomas Hoger
Modified: 2019-09-29 12:31 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-03-11 02:08:23 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1461 0 normal SHIPPED_LIVE Important: Red Hat Application Stack v2.4 security and enhancement update 2009-09-23 21:38:40 UTC
Red Hat Product Errata RHSA-2009:1579 0 normal SHIPPED_LIVE Moderate: httpd security update 2009-11-11 22:05:48 UTC
Red Hat Product Errata RHSA-2009:1580 0 normal SHIPPED_LIVE Moderate: httpd security update 2009-11-11 22:05:07 UTC
Red Hat Product Errata RHSA-2010:0011 0 normal SHIPPED_LIVE Moderate: httpd and httpd22 security update 2010-01-06 16:21:04 UTC
Red Hat Product Errata RHSA-2010:0602 0 normal SHIPPED_LIVE Moderate: Red Hat Certificate System 7.3 security update 2010-08-05 14:04:51 UTC

Description Tomas Hoger 2009-09-07 09:55:00 UTC
A NULL pointer dereference flaw was discovered in httpd's mod_proxy_ftp module. Malicious FTP server can use this flaw to crash httpd's child process via malformed reply to EPSV FTP command.

Problem was confirmed in both 2.0.x and 2.2.x httpd versions.

References:
http://www.intevydis.com/blog/?p=59
http://secunia.com/advisories/36549/

Comment 1 Tomas Hoger 2009-09-07 10:04:25 UTC
Note: The impact of this flaw is rather limited.  Using a default prefork MPM (Multi-Processing Module), this casues a crash of a httpd child process.  As with prefork MPM, only one request is served by each child process at any time, the problem only breaks current request and does not causes denial of service for whole daemon or other concurrent requests served by other child processes.

When multi-threaded worker MPM is used (not default on Red Hat Enterprise Linux or Fedora), crash of a child process can break other concurrent requests served by the same child process at the moment of the crash.  Additionally, httpd's proxying is typically used as reverse proxy, rather than forward proxy, where servers to which requests are proxied are trusted, and hence no trust boundary is crossed in such setups.

Comment 2 Tomas Hoger 2009-09-07 12:36:17 UTC
This problem is not limited to EPSV command reply.  Similar problem exists in handling of PASV command (that code is reached e.g. when FTP server does not implement EPSV).

Comment 6 Jan Lieskovsky 2009-09-09 16:08:46 UTC
MITRE's CVE-2009-3094 record:
-----------------------------

The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the
mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13
allows remote FTP servers to cause a denial of service (NULL pointer
dereference and child process crash) via a malformed reply to an EPSV
command.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3094
http://intevydis.com/vd-list.shtml
http://www.intevydis.com/blog/?p=59
http://secunia.com/advisories/36549

Comment 8 Tomas Hoger 2009-09-21 10:56:34 UTC
This affects httpd version in Red Hat Enterprise Linux 3, 4, and 5, Red Hat Application Stack v2, JBoss Enterprise Web Server, and upstream versions up to the current 2.2.13.

This was rated as having low security impact, future updates may address this flaw.

Upstream commit:
http://svn.apache.org/viewvc?view=rev&revision=814652

Comment 9 errata-xmlrpc 2009-09-23 21:39:09 UTC
This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:1461 https://rhn.redhat.com/errata/RHSA-2009-1461.html

Comment 10 Jan Lieskovsky 2009-09-25 16:07:28 UTC
Issue was fixed in upstream Apache httpd 2.2.14-dev version:

  http://httpd.apache.org/security/vulnerabilities_22.html

Comment 13 errata-xmlrpc 2009-11-11 22:09:41 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1580 https://rhn.redhat.com/errata/RHSA-2009-1580.html

Comment 14 errata-xmlrpc 2009-11-11 22:09:51 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 3

Via RHSA-2009:1579 https://rhn.redhat.com/errata/RHSA-2009-1579.html

Comment 16 Fedora Update System 2009-12-03 15:57:06 UTC
httpd-2.2.14-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/httpd-2.2.14-1.fc11

Comment 17 Fedora Update System 2009-12-03 16:28:16 UTC
httpd-2.2.14-1.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/httpd-2.2.14-1.fc10

Comment 18 Fedora Update System 2009-12-10 04:17:05 UTC
httpd-2.2.14-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2009-12-18 04:21:59 UTC
httpd-2.2.14-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 20 errata-xmlrpc 2010-01-06 16:21:17 UTC
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4
  JBEWS 1.0.0 for RHEL 5

Via RHSA-2010:0011 https://rhn.redhat.com/errata/RHSA-2010-0011.html

Comment 21 Fedora Update System 2010-02-27 03:40:37 UTC
httpd-2.2.14-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 22 errata-xmlrpc 2010-08-04 21:31:17 UTC
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html


Note You need to log in before you can comment on or make changes to this bug.