A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.

A possible stack overflow in apache2-mod_fcgid due to wrong pointer arithmetic has been fixed. CVE-2010-3872 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-201207-09 (mod_fcgid: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in mod_fcgid:
      An error in the 'fcgid_header_bucket_read()' function in         fcgid_bucket.c could cause a stack-based buffer overflow         (CVE-2010-3872).
      An error in the 'is_spawn_allowed() function in fcgid_spawn_ctl.c         prevents Apache from recognizing the FcgidMaxProcessesPerClass         directive for a virtual host (CVE-2012-1181).
  Impact :

    A local attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
      Furthermore, a remote attacker could send specially crafted HTTP       requests, possibly resulting in a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

According to its self-reported banner, the Apache web server listening on this port includes a version of the mod_fcgid module earlier than 2.3.6.  As such, it has a stack-based buffer overflow vulnerability because of an error in the pointer arithmetic used in the 'fcgid_header_bucket_read()' function.

An unauthenticated, remote attacker can leverage this with a specially crafted request to overwrite data on the stack, leading to an application crash or possibly even arbitrary code execution subject to the privileges under which the web server operates.

A vulnerability has been found in Apache mod_fcgid. The Common Vulnerabilities and Exposures project identifies the following problem :

  - CVE-2010-3872     A stack overflow could allow an untrusted FCGI     application to cause a server crash or possibly to     execute arbitrary code as the user running the web     server.

This update to the current upstream maintenance release includes a fix for a possible stack buffer overwrite (CVE-2010-3872).

It also changes the default value of FcgidMaxRequestLen from 1GB to 128K; administrators should change this to an appropriate value based on site requirements.

Other changes are described in CHANGES-FCGID document included in the package.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75428	openSUSE Security Update : apache2-mod_fcgid (openSUSE-SU-2011:0884-1)	Nessus	SuSE Local Security Checks	high
59901	GLSA-201207-09 : mod_fcgid: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
54607	Apache mod_fcgid Module fcgid_header_bucket_read() Function Remote Stack Buffer Overflow	Nessus	Web Servers	high
51427	Debian DSA-2140-1 : libapache2-mod-fcgid - stack overflow	Nessus	Debian Local Security Checks	high
50617	Fedora 12 : mod_fcgid-2.3.6-1.fc12 (2010-17474)	Nessus	Fedora Local Security Checks	high
50616	Fedora 14 : mod_fcgid-2.3.6-1.fc14 (2010-17472)	Nessus	Fedora Local Security Checks	high
50615	Fedora 13 : mod_fcgid-2.3.6-1.fc13 (2010-17434)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2010-3872

high

Tenable Plugins

high

high

high

high

high

high

high