Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.

The libapache-mod-ssl package provides SSL capability to the apache webserver. Recently, a problem has been found in the handling of .htaccess files, allowing arbitrary code execution as the web server user (regardless of ExecCGI / suexec settings), DoS attacks (killing off apache children), and allowing someone to take control of apache child processes - all through specially crafted .htaccess files.

The remote Apache server is running a version of mod_ssl which contains a off-by-one buffer overflow. An attacker with write access to a .htacess file could exploit this bug to execute arbitrary code on this host with the privileges the web server is running.

Frank Denis discovered an off-by-one error in mod_ssl dealing with the handling of older configuration directorives (the rewrite_command hook). A malicious user could use a specially crafted .htaccess file to execute arbitrary commands as the apache user or execute a DoS against the apache child processes.

This vulnerability is fixed in mod_ssl 2.8.10; patches have been applied to correct this problem in these packages.

Updated mod_ssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.

The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Versions of mod_ssl prior to 2.8.10 are subject to a single NULL overflow that can cause arbitrary code execution.

In order to exploit this vulnerability, the Apache Web server has to be configured to allow overriding of configuration settings on a per-directory basis, and untrusted local users must be able to modify a directory in which the server is configured to allow overriding. The local attacker may then become the user that Apache is running as (usually 'www' or 'nobody').

Note that regardless of this bug, local users can obtain the same privileges if the server is configured to allow them to create CGI scripts which run as the Web server user, or if PHP is enabled but not configured in 'safe mode'.

The errata packages contain versions of mod_ssl that have been patched and are not vulnerable to this issue.

Please note that you must restart the httpd daemon to use the updated module. For instructions on doing this, see the bottom of the Solutions section below.

The remote host is using a version of mod_ssl that is older than 2.8.10.

This version is vulnerable to an off-by-one buffer overflow that could allow a user with write access to .htaccess files to execute arbitrary code on the system with permissions of the web server.

*** Note that several Linux distributions (such as RedHat) *** patched the old version of this module. Therefore, this *** might be a false positive. Please check with your vendor *** to determine if you really are vulnerable to this flaw

ID	Name	Product	Family	Severity
14972	Debian DSA-135-1 : libapache-mod-ssl - buffer overflow / DoS	Nessus	Debian Local Security Checks	medium
1512	Apache mod_ssl < 2.8.10 Off-by-one Overflow	Nessus Network Monitor	Web Servers	medium
13951	Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:048)	Nessus	Mandriva Local Security Checks	medium
12310	RHEL 2.1 : mod_ssl (RHSA-2002:136)	Nessus	Red Hat Local Security Checks	medium
11039	Apache mod_ssl ssl_compat_directive Function Overflow	Nessus	Web Servers	medium
800580	Apache mod_ssl < 2.8.10 Off-by-one Overflow	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2002-0653

high

Tenable Plugins

medium

medium

medium

medium

medium

medium