Bug 769844 - (CVE-2011-3607) CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20111102,reported=2...
: Security
Depends On: 746695 746696 746697 785070 787596 787597 787598 787599
Blocks: 750936
  Show dependency treegraph
 
Reported: 2011-12-22 08:44 EST by Ramon de C Valle
Modified: 2016-03-04 06:23 EST (History)
8 users (show)

See Also:
Fixed In Version: httpd 2.2.22
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-05-07 15:34:11 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Ramon de C Valle 2011-12-22 08:44:51 EST
Vincent Danen 2011-11-02 17:14:55 EDT

It was reported [1] that an integer overflow was found in Apache in the
ap_pregsub() function called from mod-setenvif.  When a header field is mangled
using SetEnvIf, the new environment variable data can be multiples of the size
of the submitted header field.  This would cause ap_pregsub() to overflow the
length value in buffer size calculations, leading to the subsequent allocation
call of a too-small buffer.  Filling this buffer with user-supplied data will
lead to a buffer overflow.

Depending on the input data, this can lead to excessive allocation of server
memory (resulting in killed processes due to out-of-memory conditions), invalid
memory access when copying large amounts of data (which can lead to a
termination of the httpd process), or possibly allowing the execution of
arbitrary code.

To trigger this flaw, mod_setenvif must be enabled (the default) and the
attacker needs to be able to place a crafted .htaccess file on the server
(which, in most cases, would require local access to the file system or some
web interface that allows for writing arbitrary files to the local file system,
such as for custom .htaccess files).

There is currently no upstream fix, however to work around the problem, disable
mod_setenvif.

[1] http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/
Comment 1 Tomas Hoger 2012-01-12 05:06:25 EST
This issue was originally tracked with CVE-2011-4415 via bug #750935.

Patch for this issue was added upstream to trunk (future 2.4.x httpd versions) via following commit:
  http://svn.apache.org/viewvc?view=revision&revision=1198940

That fix is not applicable to older httpd versions, such as 2.2.x.  There still on-going upstream discussion on how to address this in older httpd versions:
  http://thread.gmane.org/gmane.comp.apache.devel/46260
Comment 2 Ramon de C Valle 2012-01-24 09:49:21 EST
There are still no follow up on this discussion.
Comment 3 Tomas Hoger 2012-01-26 09:46:10 EST
Following fix is already committed in upstream SVN for 2.2.x:
  http://svn.apache.org/viewvc?view=revision&revision=1227280
Comment 4 Ramon de C Valle 2012-01-27 04:02:09 EST
Theese are the only exploits/reproducers currently available/released for this:
http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html
Comment 6 errata-xmlrpc 2012-02-13 15:34:26 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0128 https://rhn.redhat.com/errata/RHSA-2012-0128.html
Comment 7 errata-xmlrpc 2012-02-21 16:58:14 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0323 https://rhn.redhat.com/errata/RHSA-2012-0323.html
Comment 8 errata-xmlrpc 2012-05-07 14:48:43 EDT
This issue has been addressed in following products:

  JBoss Enterprise Web Server 1.0.2

Via RHSA-2012:0543 https://rhn.redhat.com/errata/RHSA-2012-0543.html
Comment 9 errata-xmlrpc 2012-05-07 15:17:29 EDT
This issue has been addressed in following products:

  JBEWS 1.0 for RHEL 5
  JBEWS 1.0 for RHEL 6

Via RHSA-2012:0542 https://rhn.redhat.com/errata/RHSA-2012-0542.html

Note You need to log in before you can comment on or make changes to this bug.