Multiple stack-based buffer overflows in (1) mod_alias and (2) mod_rewrite for Apache before 1.3.29 allow attackers to create configuration files to cause a denial of service (crash) or execute arbitrary code via a regular expression with more than 9 captures.

Apache httpd is a hypertext transfer protocol server, and is used by over two thirds of the Internet's web sites. Upgraded Apache packages are available for Slackware 8.1, 9.0, 9.1, and -current. These fix local vulnerabilities that could allow users who can create or edit Apache config files to gain additional privileges. Sites running Apache should upgrade to the new packages. In addition, new mod_ssl packages have been prepared for all platforms, and new PHP packages have been prepared for Slackware 8.1, 9.0, and - -current (9.1 already uses PHP 4.3.3). In -current, these packages also move the Apache module directory from /usr/libexec to /usr/libexec/apache. Links for all of these related packages are provided below.

SunOS 5.8_x86: Apache Patch.
Date this patch was last updated by Sun : Apr/23/08

SunOS 5.8: Apache Patch.
Date this patch was last updated by Sun : Apr/24/08

The remote host appears to be running a version of Apache 2.x that is older than 2.0.48.  This version is vulnerable to a bug that may allow a rogue CGI to disable the httpd service by issuing over 4K of data to stderr. To exploit this flaw, an attacker would need the ability to upload a rogue CGI script to this server and to have it executed by the Apache daemon (httpd).

The remote host appears to be running a version of Apache which is older  than 1.3.29  There are several flaws in this version that may allow an attacker to possibly execute arbitrary code through mod_alias and mod_rewrite.

A buffer overflow in mod_alias and mod_rewrite was discovered in Apache versions 1.3.19 and earlier as well as Apache 2.0.47 and earlier. This happens when a regular expression with more than 9 captures is confined. An attacker would have to create a carefully crafted configuration file (.htaccess or httpd.conf) in order to exploit these problems.

As well, another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used.

Apache version 2.0.48 and 1.3.29 were released upstream to correct these bugs; backported patches have been applied to the provided packages.

SunOS 5.9_x86: Apache Security Patch.
Date this patch was last updated by Sun : Mar/05/10

SunOS 5.9: Apache Security Patch.
Date this patch was last updated by Sun : Mar/05/10

The remote host is missing Security Update 2004-01-26.

This security update includes the following components :

 - Apache 1.3
 - Classic
 - Mail
 - Safari
 - Windows File Sharing

For MacOS 10.1.5, it only includes the following :

 - Mail

This update contains various fixes which may allow an attacker to execute arbitrary code on the remote host.

Updated httpd packages that fix two minor security issues in the Apache Web server are now available for Red Hat Enterprise Linux 3.

The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server.

An issue in the handling of regular expressions from configuration files was discovered in releases of the Apache HTTP Server version 2.0 prior to 2.0.48. To exploit this issue an attacker would need to have the ability to write to Apache configuration files such as .htaccess or httpd.conf. A carefully-crafted configuration file can cause an exploitable buffer overflow and would allow the attacker to execute arbitrary code in the context of the server (in default configurations as the 'apache' user). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0542 to this issue.

Users of the Apache HTTP Server should upgrade to these erratum packages, which contain backported patches correcting these issues, and are applied to Apache version 2.0.46. This update also includes fixes for a number of minor bugs found in this version of the Apache HTTP Server.

Updated Apache packages that fix a minor security issue are now available for Red Hat Enterprise Linux.

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server.

An issue in the handling of regular expressions from configuration files was discovered in releases of the Apache HTTP Server version 1.3 prior to 1.3.29. To exploit this issue an attacker would need to have the ability to write to Apache configuration files such as .htaccess or httpd.conf. A carefully-crafted configuration file can cause an exploitable buffer overflow and would allow the attacker to execute arbitrary code in the context of the server (in default configurations as the 'apache' user). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0542 to this issue.

This update also includes an alternative version of the httpd binary which supports setting the MaxClients configuration directive to values above 256.

All users of the Apache HTTP Web Server are advised to upgrade to the applicable errata packages, which contain back-ported fixes correcting the above security issue.

Note that the instructions in the 'Solution' section of this errata contain additional steps required to complete the upgrade process.

The remote host appears to be running a version of the Apache web server which is older than 1.3.29. Such versions are reportedly affected by local buffer overflow vulnerabilities in the mod_alias and mod_rewrite modules. An attacker could exploit these vulnerabilities to execute arbitrary code in the context of the affected application.

*** Note that Nessus solely relied on the version number
*** of the remote server to issue this warning. This might
*** be a false positive

The remote host appears to be running a version of Apache 2.0.x prior to 2.0.48. It is, therefore, affected by multiple vulnerabilities :

  - The mod_rewrite and mod_alias modules fail to handle     regular expressions containing more than 9 captures     resulting in a buffer overflow.

  - A vulnerability may occur in the mod_cgid module caused     by the mishandling of CGI redirect paths. This could     cause Apache to send the output of a CGI program to the     wrong client.

ID	Name	Product	Family	Severity
18742	Slackware 8.1 / 9.0 / 9.1 / current : apache security update (SSA:2003-308-01)	Nessus	Slackware Local Security Checks	high
15483	Solaris 8 (x86) : 116974-07	Nessus	Solaris Local Security Checks	critical
15482	Solaris 8 (sparc) : 116973-07	Nessus	Solaris Local Security Checks	critical
2175	Apache < 2.0.48 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
2174	Apache < 1.3.29 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
14085	Mandrake Linux Security Advisory : apache (MDKSA-2003:103)	Nessus	Mandriva Local Security Checks	critical
13593	Solaris 9 (x86) : 114145-12	Nessus	Solaris Local Security Checks	critical
13530	Solaris 9 (sparc) : 113146-13	Nessus	Solaris Local Security Checks	critical
12517	Mac OS X Multiple Vulnerabilities (Security Update 2004-01-26)	Nessus	MacOS X Local Security Checks	critical
12450	RHEL 3 : httpd (RHSA-2004:015)	Nessus	Red Hat Local Security Checks	high
12435	RHEL 2.1 : apache (RHSA-2003:360)	Nessus	Red Hat Local Security Checks	high
11915	Apache < 1.3.29 Multiple Modules Local Overflow	Nessus	Web Servers	critical
11853	Apache 2.0.x < 2.0.48 Multiple Vulnerabilities (OF, Info Disc.)	Nessus	Web Servers	critical
800585	Apache < 1.3.29 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
800583	Apache < 2.0.48 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high

Detections

Analytics

CVE-2003-0542

critical

Tenable Plugins

high

critical

critical

high

high

critical

critical

critical

critical

high

high

critical

critical

high

high