Bug 522209 (CVE-2009-3095) - CVE-2009-3095 httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header
Summary: CVE-2009-3095 httpd: mod_proxy_ftp FTP command injection via Authorization HT...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-3095
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 523831 534038 534039 534040 534041 534042 534086 534088 538228
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-09 18:46 UTC by Tomas Hoger
Modified: 2019-09-29 12:32 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-08-21 22:39:47 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1461 0 normal SHIPPED_LIVE Important: Red Hat Application Stack v2.4 security and enhancement update 2009-09-23 21:38:40 UTC
Red Hat Product Errata RHSA-2009:1579 0 normal SHIPPED_LIVE Moderate: httpd security update 2009-11-11 22:05:48 UTC
Red Hat Product Errata RHSA-2009:1580 0 normal SHIPPED_LIVE Moderate: httpd security update 2009-11-11 22:05:07 UTC
Red Hat Product Errata RHSA-2010:0011 0 normal SHIPPED_LIVE Moderate: httpd and httpd22 security update 2010-01-06 16:21:04 UTC
Red Hat Product Errata RHSA-2010:0602 0 normal SHIPPED_LIVE Moderate: Red Hat Certificate System 7.3 security update 2010-08-05 14:04:51 UTC

Description Tomas Hoger 2009-09-09 18:46:08 UTC
The mod_proxy_ftp module in the Apache HTTP Server allows remote
attackers to bypass intended access restrictions and send arbitrary
commands to an FTP server via vectors related to the embedding of
these commands in the Authorization HTTP header, as demonstrated by a
certain module in VulnDisco Pack Professional 8.11. NOTE: as of
20090903, this disclosure has no actionable information. However,
because the VulnDisco Pack author is a reliable researcher, the issue
is being assigned a CVE identifier for tracking purposes.

References:
http://intevydis.com/vd-list.shtml

Comment 5 Tomas Hoger 2009-09-21 10:53:57 UTC
This issue affects httpd 2.0.x versions as shipped in Red Hat Enterprise Linux 3 and 4 (older 2.0.x version may be affected too), and httpd 2.2.x up to the current upstream version 2.2.13 and hence including versions shipped in Red Hat Enterprise Linux 5, Red Hat Application Stack v2 and JBoss Enterprise Web Server.

This issue has very limited impact.  It allows attacker to inject FTP commands via Authorization HTTP header.  Commands can be embedded as part of user name or password.

Injecting commands as part of the user name will not give attacker any extra privileges on the proxied-to FTP server, as those commands will be processed by the server before the authentication is finished and hence are unlikely to trigger anything but an authentication error.

When trying to inject FTP commands as part of the password, command may be executed post-authentication if an attacker knows the right password.  Commands will be executed on behalf of the authenticated FTP user.  Hence no trust boundary is crossed, at attacker can do the same (and more) via direct connection to the FTP server.

This was rated as having low security impact.  Future httpd updates may address this flaw.  We do not currently plan to release updates to only address this flaw.

Upstream commit:
http://svn.apache.org/viewvc?view=rev&revision=814045

Comment 6 errata-xmlrpc 2009-09-23 21:38:59 UTC
This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:1461 https://rhn.redhat.com/errata/RHSA-2009-1461.html

Comment 7 Jan Lieskovsky 2009-09-25 16:08:03 UTC
Issue was fixed in upstream Apache httpd 2.2.14-dev version:

  http://httpd.apache.org/security/vulnerabilities_22.html

Comment 10 errata-xmlrpc 2009-11-11 22:09:33 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1580 https://rhn.redhat.com/errata/RHSA-2009-1580.html

Comment 11 errata-xmlrpc 2009-11-11 22:09:40 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 3

Via RHSA-2009:1579 https://rhn.redhat.com/errata/RHSA-2009-1579.html

Comment 13 Fedora Update System 2009-12-03 15:57:12 UTC
httpd-2.2.14-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/httpd-2.2.14-1.fc11

Comment 14 Fedora Update System 2009-12-03 16:28:22 UTC
httpd-2.2.14-1.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/httpd-2.2.14-1.fc10

Comment 15 Fedora Update System 2009-12-10 04:17:10 UTC
httpd-2.2.14-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2009-12-18 04:22:06 UTC
httpd-2.2.14-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 errata-xmlrpc 2010-01-06 16:21:08 UTC
This issue has been addressed in following products:

  JBEWS 1.0.0 for RHEL 4
  JBEWS 1.0.0 for RHEL 5

Via RHSA-2010:0011 https://rhn.redhat.com/errata/RHSA-2010-0011.html

Comment 18 Fedora Update System 2010-02-27 03:40:43 UTC
httpd-2.2.14-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 19 errata-xmlrpc 2010-08-04 21:31:06 UTC
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html


Note You need to log in before you can comment on or make changes to this bug.