bugtraq - Apache Multiple Injection Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070214052036.20529.qmail@securityfocus.com>
Date: 14 Feb 2007 05:20:36 -0000
From: hugo@...ohacking.com
To: bugtraq@...urityfocus.com
Subject: Apache Multiple Injection Vulnerabilities

There's a new advisory at:
http://www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/apache/index.html

Summarizing:

"1.- HTTP 404 error response almost arbitrary injection (Apache)

Impact right now:

a) fake virus injection in Apache 404 HTTP responses wich can lead in alarms on corporate gateway antivirus, lose of trust on supposed trusted sites, end user paranoid...

b) Control codes injection -backspaces, etc.- thus allowing script injection in the server response. Right now it seems that this vulnerability is not
affecting real browsers, just because of the "backspace" escaping in the clients, or due to other things. Anyway, the problem is that echoing back control codes is a violation of the Content-Type charset in the response and is IMHO a security risk.

Impact in the future: REAL injection in Apache 404 HTTP responses of almost any kind of file, that is virus, binaries, trojans, etc. The attacker must
be able to modify the "Content-Type" HTTP header of the server response. Also, due to some restrictions in the injected "payload", the attacker must avoid
using some chars like null bytes.

2.- Location HTTP header injection in server redirect responses (Apache, IIS, Zeus 3.2, Google Web Server, Jigsaw/2.2.5, probably many
others)

Impact: Depending on the affected web server it could be a Denial of Service -when combined with a proxy caché poisoning-, HTTP URL redirection, etc."