Title: Apache Web Server MS-DOS Device Name Arbitrary Code Execution Vulnerability
Severity: HIGH
Description:
Apache is a freely available Web server for Unix and Linux variants, as well as Microsoft operating systems.
A vulnerability has been reported in Apache Web server for Microsoft Windows 9x/Me operating environments. The vulnerability exists in the way some HTTP requests are handled by the Apache Web server. Specifically, the issue exists due to the way some CGI input is redirected when the ScriptAlias directive is enabled.
The ScriptAlias directive is used to map between URLs and paths residing outside of the DocumentRoot. This directive also enables the target directory as containing only CGI scripts.
An attacker can exploit this vulnerability by making a malformed HTTP POST request to 'con.xxx' in a directory enabled with ScriptAlias. When this malformed POST data is sent to a CGI, it may result in any malicious code to be executed by the requested CGI.
This vulnerability exists for Apache versions prior to 2.0.44 for Microsoft Windows 9x/Me operating environments.
Affected Products:
- Apache Software Foundation Apache 2.0.36
- Apache Software Foundation Apache 2.0.37
- Apache Software Foundation Apache 2.0.38
- Apache Software Foundation Apache 2.0.39
- Apache Software Foundation Apache 2.0.40
- Apache Software Foundation Apache 2.0.41
- Apache Software Foundation Apache 2.0.42
- Apache Software Foundation Apache 2.0.43
- Gentoo Linux 1.2.0
- Gentoo Linux 1.4.0 _rc1
- IBM HTTP Server 2.0.42
- IBM HTTP Server 2.0.42 .1
- IBM HTTP Server 2.0.42 .2
- RedHat Linux 8.0.0
- RedHat Linux 9.0.0 i386
- Terra Soft Solutions Yellow Dog Linux 3.0.0
- Yellow Dog Linux Yellow Dog Linux 3.0.0
References:
- Apache Software Foundation: Apache 2.0.44 Released
- Apache Software Foundation: Apache httpd Release 2.0 Changes
- mattmurphy@kc.rr.com: Path Parsing Errata in Apache HTTP Server
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
