Apache mod_ssl Off-by-one Buffer Overflow in Processing CRLs May Let Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1014575 |
|
SecurityTracker URL: http://securitytracker.com/id/1014575
|
|
CVE Reference:
CAN-2005-1268
(Links to External Site)
|
Updated: Jul 27 2005
|
Original Entry Date: Jul 26 2005
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in Apache mod_ssl in the processing of certificate revocation lists (CRLs). A remote user may be able to cause denial of service conditions.
A remote user can create a specially crafted CRL that, when processed by the Apache mod_ssl callback function, will trigger an off-by-one buffer overflow. A remote user can cause the Apache server child process to crash.
The vulnerability can be triggered when printing CRL information at the 'debug' LogLevel.
The vulnerability resides in 'ssl_engine_kernel.c' in the ssl_callback_SSLVerify_CRL() function.
Marc Stern from CSC is credited with discovering this vulnerability.
[Editor's note: It is not clear if this vulnerability can be exploited to execute arbitrary code or not. Several reports have indicated that denial of service is the most likely impact.]
|
Impact:
A remote user may be able to cause the affected Apache child process to crash.
[Editor's note: It is not clear if this vulnerability can be exploited to execute arbitrary code or not. Several reports have indicated that denial of service is the most likely impact.]
|
Solution:
The vendor has issued a source code fix, available via SVN.
|
Vendor URL: httpd.apache.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 25 Jul 2005 22:03:42 -0400
Subject: [none]
|
CVE: CAN-2005-1268
Red Hat wrote:
> Marc Stern reported an off-by-one overflow in the mod_ssl CRL verification
> callback. In order to exploit this issue the Apache server would need to be
> configured to use a malicious certificate revocation list (CRL)
|
|
