|
 | 作者: Juner [juner]
 论坛用户 |
登录 |
Apache的bug描述（这个bug只在win32上有）： List: bugtraq Subject: Vulnerability in Apache for Win32 batch file processing - Remote From: Ory Segal <ORY.SEGAL@SANCTUMINC.COM> Date: 2002-03-21 17:06:46 [Download message RAW] Vulnerability in Apache for Win32 batch file processing - Remote command execution => Author: Ory Segal, Sanctum inc. http://www.sanctuminc.com => Release date: March, 21st 2002 (Vendor was notified at: Feb. 13th 2002) => Vendor: Apache group => Product: Apache web server (Win32) - Running DOS batch files Tested on: - Apache 1.3.23 - Apache 2.0.28-BETA (By default includes /cgi-bin/test-cgi.bat file which enables this attack) => Severity: High, remote command execution and arbitrary file viewing. => CVE candidate: CAN-2002-0061 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0061) => Summary: Because of a the way Apache web server handles DOS batch scripts it is possible to execute remote commands on the web server by using the pipe ('|') character. ** IMPORTANT ** The Apache 2.0.x installation is shipped with the default script /cgi-bin/test-cgi.bat which can be exploited, but it should be noted that ANY '.bat' or '.cmd' script will allow exploitation of this vulnerability. => Description: When a request for a DOS batch file (.bat or .cmd) is sent to an Apache web server, the server will spawn a shell interpreter (cmd.exe by default) and will run the script with the parameters sent to it by the user. Because no proper validation is done on the input, it is possible to send a pipe character ('|') with commands appended to it as parameters to the CGI script, and the shell interpreter will execute them. Example: 1) http://TARGET/cgi-bin/test-cgi.bat?|copy+..\conf\httpd.conf+..\htdocs\httpd. conf This request will copy the httpd.conf file residing in the /conf directory of the Apache installation, into the virtual web root where it can be viewed by any user. 2) http://TARGET/cgi-bin/test-cgi.bat?|echo+Foobar+>>+..\htdocs\index.html This will append the string "Foobar" to the index.html file residing in the virtual web root directory. 3) http://TARGET/cgi-bin/test-cgi.bat?|dir+c:+>..\htdocs\dir.txt This will create a file containing the directory listing of the C: drive, and will put the file in the virtual web root, where any user can read it. ** Notes: 1) Url-Decoding is not provided by Apache except for the '+' character which is substituted by a space character. 2) Spilling the output into the STDOUT would most likely cause Apache to write an error message since it expects the STDOUT of a CGI script to have an HTTP response format (potential HTTP headers followed by a mandatory blank line followed by a response body). Therefore in order to view the result of a command, it is recommended that you redirect the output to a file under the web server's virtual root. => Solution: Upgrade your Apache web server to: 1.3.24 (which should be available later today), or 2.0.34-beta (which will be published soon). Downloads are located at: http://www.apache.org/dist/httpd/ <<apache_advisory.txt>> Ory Segal Sanctum, Inc. http://www.SanctumInc.com/ ["apache_advisory.txt" (text/plain)] /////////////////////////////////////////////////////////////////////////////// //==========================>> Security Advisory <<==========================// /////////////////////////////////////////////////////////////////////////////// -------------------------------------------------------------------- Vulnerability in Apache for Win32 batch file processing - Remote command execution -------------------------------------------------------------------- => Author: Ory Segal, Sanctum inc. http://www.sanctuminc.com => Release date: March, 21st 2002 (Vendor was notified at: Feb. 13th 2002) => Vendor: Apache group => Product: Apache web server (Win32) - Running DOS batch files Tested on: - Apache 1.3.23 - Apache 2.0.28-BETA (By default includes /cgi-bin/test-cgi.bat file which enables this attack) => Severity: High, remote command execution and arbitrary file viewing. => CVE candidate: CAN-2002-0061 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0061) => Summary: Because of a the way Apache web server handles DOS batch scripts it is possible to execute remote commands on the web server by using the pipe ('|') character. ** IMPORTANT ** The Apache 2.0.x installation is shipped with the default script /cgi-bin/test-cgi.bat which can be exploited, but it should be noted that ANY '.bat' or '.cmd' script will allow exploitation of this vulnerability. => Description: When a request for a DOS batch file (.bat or .cmd) is sent to an Apache web server, the server will spawn a shell interpreter (cmd.exe by default) and will run the script with the parameters sent to it by the user. Because no proper validation is done on the input, it is possible to send a pipe character ('|') with commands appended to it as parameters to the CGI script, and the shell interpreter will execute them. Example: 1) http://TARGET/cgi-bin/test-cgi.bat?|copy+..\conf\httpd.conf+..\htdocs\httpd.conf This request will copy the httpd.conf file residing in the /conf directory of the Apache installation, into the virtual web root where it can be viewed by any user. 2) http://TARGET/cgi-bin/test-cgi.bat?|echo+Foobar+>>+..\htdocs\index.html This will append the string "Foobar" to the index.html file residing in the virtual web root directory. 3) http://TARGET/cgi-bin/test-cgi.bat?|dir+c:+>..\htdocs\dir.txt This will create a file containing the directory listing of the C: drive, and will put the file in the virtual web root, where any user can read it. ** Notes: 1) Url-Decoding is not provided by Apache except for the '+' character which is substituted by a space character. 2) Spilling the output into the STDOUT would most likely cause Apache to write an error message since it expects the STDOUT of a CGI script to have an HTTP response format (potential HTTP headers followed by a mandatory blank line followed by a response body). Therefore in order to view the result of a command, it is recommended that you redirect the output to a file under the web server's virtual root. => Solution: Upgrade your Apache web server to: 1.3.24 (which should be available later today), or 2.0.34-beta (which will be published soon). Downloads are located at: http://www.apache.org/dist/httpd/ ------_=_NextPart_000_01C1D0F9.9FC115B0-- 快去补吧! （不知道是不是大家都知道了？我是今天才看到） |
| 地主 发表时间: 03/31 19:47 |
 | 回复: xiaojun [xiaojun]  剑客 |
登录 |
|
看起来可够费劲的了，好在我还认识几个洋文~~~~~~~~~~~~~ |
| B1层 发表时间: 03/31 22:02 |
| 回复: Juner [juner] 论坛用户 |
登录 |
|
呵呵，不好意思。 下次我会翻译的！ :=) |
| B2层 发表时间: 04/05 21:19 |
|
20CN网络安全小组版权所有
Copyright © 2000-2010 20CN Security Group. All Rights Reserved.
论坛程序编写：NetDemon
粤ICP备05087286号
论坛: 菜鸟乐园 标题: Apache 的1.3.24解决了那个新的bug！