发布日期：2004-06-10
更新日期：2004-06-17

受影响系统：

Apache Software Foundation Apache 1.3.31
Apache Software Foundation Apache 1.3.29
Apache Software Foundation Apache 1.3.28
Apache Software Foundation Apache 1.3.26
Apache Software Foundation Apache 1.3.25
Apache Software Foundation Apache 1.3.27
    - Conectiva Linux 9.0
    - Conectiva Linux 8.0
    - Debian Linux 3.0
    - FreeBSD 4.9
    - FreeBSD 4.7
    - RedHat Linux 8.0
    - RedHat Linux 7.3
    - Sun Solaris 8.0
    - Sun Solaris 7.0

不受影响系统：

Apache Software Foundation Apache 2.0.49
Apache Software Foundation Apache 2.0.48
Apache Software Foundation Apache 2.0.47
Apache Software Foundation Apache 2.0.46
Apache Software Foundation Apache 2.0.45
Apache Software Foundation Apache 2.0.44
Apache Software Foundation Apache 2.0.43
Apache Software Foundation Apache 2.0.42
Apache Software Foundation Apache 2.0.41
Apache Software Foundation Apache 2.0.40
Apache Software Foundation Apache 2.0.39
Apache Software Foundation Apache 2.0.38
Apache Software Foundation Apache 2.0.37
Apache Software Foundation Apache 2.0.36
Apache Software Foundation Apache 2.0.35
Apache Software Foundation Apache 2.0.32
Apache Software Foundation Apache 2.0.28
Apache Software Foundation Apache 2.0

描述：

---

CVE(CAN) ID: CVE-2004-0492

mod_proxy是一个可在Apache使用的代理模块。

mod_proxy在处理负的Content-Length值时存在问题，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以Apache进程权限在系统上执行任意指令。

连接远程服务器使其返回非法(负值)的Content-Length，可使Mod_proxy触发基于整数的溢出，会导致Apache子进程崩溃。问题存在于proxy_util.c中：

n = ap_bread(f, buf, MIN((int)buf_size,
(int)(len - total_bytes_rcvd)));

这里len可为负值。
                          
在旧的OpenBSD/FreeBSD系统中可利用memcpy的反向拷贝实现来执行任意指令。新的BSD系统中由于攻击者可以控制3个任意字节也能用于执行任意指令。如果define AP_ENABLE_EXCEPTION_HOOK启用的情况下，可能在任何平台都可被利用。

<*来源：Georgi Guninski （guninski@guninski.com）
  
  链接：http://marc.theaimsgroup.com/?l=full-disclosure&m=108688168827579&w=2
        http://marc.theaimsgroup.com/?l=apache-httpd-dev&m=108687304202140
*>

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* Georgi Guninski提供如下第三方补丁：

-------------------------------------
diff -u apache_1.3.31/src/modules/proxy/proxy_util.c apache_1.3.31my/src/modules/proxy/proxy_util.c
--- apache_1.3.31/src/modules/proxy/proxy_util.c        Tue Feb 17 23:52:22 2004
+++ apache_1.3.31my/src/modules/proxy/proxy_util.c      Tue Jun  8 11:24:15 2004
@@ -545,8 +545,8 @@
                 n = ap_bread(f, buf, buf_size);
             }
             else {
-                n = ap_bread(f, buf, MIN((int)buf_size,
-                                         (int)(len - total_bytes_rcvd)));
+                n = ap_bread(f, buf, MIN((size_t)buf_size,
+                                         (size_t)(len - total_bytes_rcvd)));
             }
         }
-------------------------------------

或者NSFOCUS建议您不要打开mod_proxy模块。

厂商补丁：

Apache Software Foundation
--------------------------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Index: src/CHANGES
===================================================================
RCS file: /home/cvs/apache-1.3/src/CHANGES,v
retrieving revision 1.1942
diff -u -p -u -r1.1942 CHANGES
--- src/CHANGES    2 Jun 2004 22:49:03 -0000    1.1942
+++ src/CHANGES    9 Jun 2004 15:58:44 -0000
@@ -1,5 +1,9 @@
Changes with Apache 1.3.32

+  *) SECURITY: CAN-2004-0492 (cve.mitre.org)
+     Reject responses from a remote server if sent an invalid (negative)
+     Content-Length.  [Mark Cox]
+
   *) Fix a bunch of cases where the return code of the regex compiler
      was not checked properly. This affects mod_usertrack and
      core. PR 28218.  [Andr?Malo]
Index: src/modules/proxy/proxy_http.c
===================================================================
RCS file: /home/cvs/apache-1.3/src/modules/proxy/proxy_http.c,v
retrieving revision 1.106
diff -u -p -u -r1.106 proxy_http.c
--- src/modules/proxy/proxy_http.c    29 Mar 2004 17:47:15 -0000    1.106
+++ src/modules/proxy/proxy_http.c    8 Jun 2004 14:23:05 -0000
@@ -485,6 +485,13 @@ int ap_proxy_http_handler(request_rec *r
         content_length = ap_table_get(resp_hdrs, "Content-Length");
         if (content_length != NULL) {
             c->len = ap_strtol(content_length, NULL, 10);
+
+        if (c->len < 0) {
+        ap_kill_timeout(r);
+        return ap_proxyerror(r, HTTP_BAD_GATEWAY, ap_pstrcat(r->pool,
+                     "Invalid Content-Length from remote server",
+                                      NULL));
+        }
         }

     }

浏览次数：8753
严重程度：0（网友投票）