|
|
Apache2 mod_cgi STDERR拒绝服务攻击漏洞
发布时间：2003-09-29
更新时间：2003-09-29
严重程度：中
威胁程度：远程拒绝服务
错误类型：设计错误
利用方式：服务器模式
BUGTRAQ ID：8725
受影响系统Apache Software Foundation Apache 1.3.27
+HP HP-UX (VVOS) 11.0 4
+HP VirtualVault 4.5
+HP VirtualVault 4.6
+HP Webproxy 2.0
+OpenPKG OpenPKG Current
+SGI IRIX 6.5.19
Apache Software Foundation Apache 2.0 a9
Apache Software Foundation Apache 2.0
Apache Software Foundation Apache 2.0.28
Apache Software Foundation Apache 2.0.32
Apache Software Foundation Apache 2.0.35
Apache Software Foundation Apache 2.0.36
Apache Software Foundation Apache 2.0.37
Apache Software Foundation Apache 2.0.38
Apache Software Foundation Apache 2.0.39
Apache Software Foundation Apache 2.0.40
+RedHat Linux 8.0
+RedHat Linux 9.0 i386
+Terra Soft Solutions Yellow Dog Linux 3.0
Apache Software Foundation Apache 2.0.41
Apache Software Foundation Apache 2.0.42
+Gentoo Linux 1.2
+Gentoo Linux 1.4 _rc1
Apache Software Foundation Apache 2.0.43
Apache Software Foundation Apache 2.0.44
+MandrakeSoft Linux Mandrake 9.1
+MandrakeSoft Linux Mandrake 9.1 ppc
Apache Software Foundation Apache 2.0.45
-Apple MacOS X 10.0
-Apple MacOS X 10.0.1
-Apple MacOS X 10.0.2
-Apple MacOS X 10.0.3
-Apple MacOS X 10.0.4
-Apple MacOS X 10.1
-Apple MacOS X 10.1
-Apple MacOS X 10.1.1
-Apple MacOS X 10.1.2
-Apple MacOS X 10.1.3
-Apple MacOS X 10.1.4
-Apple MacOS X 10.1.5
-Apple MacOS X 10.2
-Apple MacOS X 10.2.1
-Apple MacOS X 10.2.2
-Apple MacOS X 10.2.3
-Apple MacOS X 10.2.4
-Apple MacOS X 10.2.5
-Apple MacOS X 10.2.6
+Conectiva Linux 9.0
Apache Software Foundation Apache 2.0.46
+Trustix Secure Linux 2.0
Apache Software Foundation Apache 2.0.47 详细描述
Apache2的mod_cgi实现上存在漏洞，一个恶意的CGI脚本可以导致Apache2停止响应。因为mod_cgi只有从脚本的STDOUT读入完信息以后才会向STDERR写入，而STDERR只缓存4096字节的数据，所以当CGI脚本向STDERR输出超过4096字他的数据时可能导致脚本的write()调用挂起，因为Apache2等待从恶意脚本的STDOUT读入数据，httpd进程就会挂起。当达到连接限制的时候Apache就不再响应请求，从而导致拒绝服务。
解决方案
厂商已经在最新的CVS中修补了此漏洞：
http://www.apache.org/
相关信息
SECURITY: 4097+ bytes of stderr from cgi script causes script to hang
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22030
|
