Apache 2.0 vulnerability affects non-Unix platforms

[Mark J Cox <mj...@apache.org>]

-----BEGIN PGP SIGNED MESSAGE-----

For Immediate Disclosure

=============== SUMMARY ================

        Title: Apache 2.0 vulnerability affects non-Unix platforms
         Date: 9th August 2002
      Version: 1
 Product Name: Apache web server 2.0
  OS/Platform: Windows, OS2, Netware
Permanent URL: http://httpd.apache.org/info/security_bulletin_20020908a.txt
  Vendor Name: Apache Software Foundation
   Vendor URL: http://www.apache.org/
      Affects: All Released versions of 2.0 through 2.0.39
     Fixed in: 2.0.40
  Identifiers: CAN-2002-0661

=============== BACKGROUND ================

Apache is a powerful, full-featured, efficient, and freely-available Web
server.  On the 7th August 2002, The Apache Software Foundation was
notified of the discovery of a significant vulnerability, identified by
Auriemma Luigi <bu...@sitoverde.com>.

This vulnerability has the potential to allow an attacker to inflict
serious damage to a server, and reveal sensitive data.  This vulnerability
affects default installations of the Apache web server.

Unix and other variant platforms appear unaffected.  Cygwin users are
likely to be affected.

A simple one line workaround in the httpd.conf file will close the
vulnerability.  Prior to the first 'Alias' or 'Redirect' directive, add
the following directive to the global server configuration:

   RedirectMatch 400 "\\\.\."

Fixes for this vulnerability are also included in Apache version 2.0.40.
Apache 2.0.40 also contains some less serious security fixes.

More information will be made available by the Apache Software
Foundation and Auriemma Luigi <bu...@sitoverde.com> in the
coming weeks.

=============== REFERENCES ================

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2002-0661 to this issue.  

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0661





-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iQCVAwUBPVQBxu6tTP1JpWPZAQHCwAP9HVzSAMMrXadmRdPfEe9eFUKOxpQA4v8d
mKrLciDXnVpPlaKc7/1OHUcCwPu0IucHGUN5sF93Dw3X2BKoAjJFHnmS123r/CP6
WnHAaM+Hl17pPVxI3dXJXbiDvmpBB6b9SNCrsmf0RLykLHVZqoekOh2902Y7+Fts
NpKuwE7xzdA=
=mEuL
-----END PGP SIGNATURE-----

Re: Apache 2.0 vulnerability affects non-Unix platforms

[Aaron Bannert <aa...@clove.org>]

On Fri, Aug 16, 2002 at 04:32:33PM -0300, Andreas Hasenack wrote:
> Is "striker" going to be signing apache releases from now on?
> 
> Previously the tarballs were signed by Cliff Woolley.
> 
> 2.0.40 is signed by Sander Striker, and the KEYS file keeps on growing :)

Typically whomever volunteers to be the release manager for a particular
release will sign the source tarballs. Ideally that signature has
a well-connected web of trust to the other PMC members on our project.
Yes, the KEYS file will keep on growing as we add new people.

-aaron

Re: Apache 2.0 vulnerability affects non-Unix platforms

[Cliff Woolley <jw...@virginia.edu>]

On Fri, 16 Aug 2002, Andreas Hasenack wrote:

> Is "striker" going to be signing apache releases from now on?
> Previously the tarballs were signed by Cliff Woolley.
> 2.0.40 is signed by Sander Striker, and the KEYS file keeps on growing :)

We've been tossing around the idea of using a "role" key to sign releases,
but there are some obvious security implications to that which would need
to be hashed out in order to protect the key.  In the meanwhile, it's
signed by whichever of the core developers volunteered to be the Release
Manager.  For recent releases, that has been Sander Striker and myself.
Sander did 2.0.36, I did 2.0.37-2.0.39, and Sander did 2.0.40.  I might do
2.0.41, but that's as yet not decided.

Anyway, we are trying to address this issue.  :)

--Cliff

Re: Apache 2.0 vulnerability affects non-Unix platforms

[Andreas Hasenack <an...@conectiva.com.br>]

Is "striker" going to be signing apache releases from now on?

Previously the tarballs were signed by Cliff Woolley.

2.0.40 is signed by Sander Striker, and the KEYS file keeps on growing :)

Re: Apache 2.0 vulnerability affects non-Unix platforms

[Mark J Cox <ma...@awe.com>]

> Incidentally, I didn't see this get sent to users@httpd and 
> announce@httpd (it was sent to announce@apache.org).  Did I miss it?

Doh.  So thats two mistakes, where is the third?

Mark

Re: Apache 2.0 vulnerability affects non-Unix platforms

[Joshua Slive <jo...@slive.ca>]

Mark J Cox wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> For Immediate Disclosure

Incidentally, I didn't see this get sent to users@httpd and 
announce@httpd (it was sent to announce@apache.org).  Did I miss it?

Joshua.