HTTP: Chunk Overflow

This protocol anomaly triggers when an invalid data chunk length in an HTTP request that uses chunked encoding is detected. The chunked encoding transfer method sends data length requests followed by data chunks that match the negotiated data lengths. Attackers can cause a stack overflow and execute arbitrary code on the server.

Extended Description

When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper (signed) interpretation of an unsigned integer value. Consequently, several conditions that have security implications may occur. Reportedly, a buffer overrun and signal race condition occur. Exploiting these conditions may allow arbitrary code to run. **Update**: Reportedly, at least one worm is exploiting this vulnerability to propagate in the wild. The worm targets FreeBSD 4.5 systems running Apache 1.3.22-24 and 1.3.20. Other versions may also be affected.

Affected Products

Oracle oracle_http_server

References

BugTraq: 5033 37966 17202

CVE: CVE-2005-2922

URL: http://httpd.apache.org/info/security_bulletin_20020620.txt

Short Name

HTTP:OVERFLOW:CHUNK-OVERFLOW

Severity

Major

Recommended

False

Recommended Action

None

HTTP: Chunk Overflow

Extended Description

Affected Products

References

Found a potential security threat?