WORM: Apache "Transfer-Encoding: chunked" Worm Infection Attempt

This signature detects attempts to infect Apache Web servers with the Apache Worm. Apache versions 1.3.26, 2.0.38 and prior are vulnerable. Apache improperly calculates required buffer sizes for chunked encoded requests due to a signed interpretation of an unsigned integer value. The worm sends POST requests containing malicious chunked encoded data to exploit the Apache daemon.

Extended Description

When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper (signed) interpretation of an unsigned integer value. Consequently, several conditions that have security implications may occur. Reportedly, a buffer overrun and signal race condition occur. Exploiting these conditions may allow arbitrary code to run. **Update**: Reportedly, at least one worm is exploiting this vulnerability to propagate in the wild. The worm targets FreeBSD 4.5 systems running Apache 1.3.22-24 and 1.3.20. Other versions may also be affected.

Affected Products

Oracle oracle_http_server

References

BugTraq: 5033

CVE: CVE-2002-0392

URL: http://www.mycert.org.my/advisory/MA-044.072002.html http://httpd.apache.org/info/security_bulletin_20020617.txt

Short Name

WORM:CHUNKED-WORM

Severity

Critical

Recommended

False

Recommended Action

Drop

WORM: Apache "Transfer-Encoding: chunked" Worm Infection Attempt

Extended Description

Affected Products

References

Found a potential security threat?