Bug 769844 (CVE-2011-3607) - CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
Summary: CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
Status: CLOSED ERRATA
Alias: CVE-2011-3607
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20111102,reported=2...
Keywords: Security
Depends On: 746695 746696 746697 785070 787596 787597 787598 787599
Blocks: 750936
TreeView+ depends on / blocked
 
Reported: 2011-12-22 13:44 UTC by Ramon de C Valle
Modified: 2019-06-08 18:59 UTC (History)
8 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2012-05-07 19:34:11 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:0128 normal SHIPPED_LIVE Moderate: httpd security update 2012-02-14 01:33:00 UTC
Red Hat Product Errata RHSA-2012:0323 normal SHIPPED_LIVE Moderate: httpd security update 2012-02-22 02:57:25 UTC
Red Hat Product Errata RHSA-2012:0542 normal SHIPPED_LIVE Moderate: httpd security and bug fix update 2012-05-07 22:22:44 UTC
Red Hat Product Errata RHSA-2012:0543 normal SHIPPED_LIVE Moderate: httpd security and bug fix update 2012-05-07 22:22:11 UTC

Description Ramon de C Valle 2011-12-22 13:44:51 UTC
Vincent Danen 2011-11-02 17:14:55 EDT

It was reported [1] that an integer overflow was found in Apache in the
ap_pregsub() function called from mod-setenvif.  When a header field is mangled
using SetEnvIf, the new environment variable data can be multiples of the size
of the submitted header field.  This would cause ap_pregsub() to overflow the
length value in buffer size calculations, leading to the subsequent allocation
call of a too-small buffer.  Filling this buffer with user-supplied data will
lead to a buffer overflow.

Depending on the input data, this can lead to excessive allocation of server
memory (resulting in killed processes due to out-of-memory conditions), invalid
memory access when copying large amounts of data (which can lead to a
termination of the httpd process), or possibly allowing the execution of
arbitrary code.

To trigger this flaw, mod_setenvif must be enabled (the default) and the
attacker needs to be able to place a crafted .htaccess file on the server
(which, in most cases, would require local access to the file system or some
web interface that allows for writing arbitrary files to the local file system,
such as for custom .htaccess files).

There is currently no upstream fix, however to work around the problem, disable
mod_setenvif.

[1] http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/

Comment 1 Tomas Hoger 2012-01-12 10:06:25 UTC
This issue was originally tracked with CVE-2011-4415 via bug #750935.

Patch for this issue was added upstream to trunk (future 2.4.x httpd versions) via following commit:
  http://svn.apache.org/viewvc?view=revision&revision=1198940

That fix is not applicable to older httpd versions, such as 2.2.x.  There still on-going upstream discussion on how to address this in older httpd versions:
  http://thread.gmane.org/gmane.comp.apache.devel/46260

Comment 2 Ramon de C Valle 2012-01-24 14:49:21 UTC
There are still no follow up on this discussion.

Comment 3 Tomas Hoger 2012-01-26 14:46:10 UTC
Following fix is already committed in upstream SVN for 2.2.x:
  http://svn.apache.org/viewvc?view=revision&revision=1227280

Comment 4 Ramon de C Valle 2012-01-27 09:02:09 UTC
Theese are the only exploits/reproducers currently available/released for this:
http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html

Comment 6 errata-xmlrpc 2012-02-13 20:34:26 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0128 https://rhn.redhat.com/errata/RHSA-2012-0128.html

Comment 7 errata-xmlrpc 2012-02-21 21:58:14 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0323 https://rhn.redhat.com/errata/RHSA-2012-0323.html

Comment 8 errata-xmlrpc 2012-05-07 18:48:43 UTC
This issue has been addressed in following products:

  JBoss Enterprise Web Server 1.0.2

Via RHSA-2012:0543 https://rhn.redhat.com/errata/RHSA-2012-0543.html

Comment 9 errata-xmlrpc 2012-05-07 19:17:29 UTC
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0542 https://rhn.redhat.com/errata/RHSA-2012-0542.html


Note You need to log in before you can comment on or make changes to this bug.