Apache HTTP Server on Win32 systems does not securely handle input passed to CGI programs

Overview

A vulnerability in the Apache HTTP Server running on Win32 systems (Windows 9x/Me, Windows NT/2000/XP) could allow an attacker to execute commands with the privileges of the web server process.

Description

The Apache HTTP Server is a freely available web server that runs on a variety of operating systems including Unix, Linux, and Microsoft Windows (Win32). Apache supports the Common Gateway Interface (CGI) that defines a standard interface between the HTTP server and external applications. On Win32 systems, batch or command shell programs (files typically with .bat or .cmd extensions) can be executed via the CGI interface, and these programs are executed within a full command shell (command.com on Windows 9x/Me, cmd.exe in Windows NT/2000/XP).

Ory Segal of Sanctum has reported a vulnerability in which Apache on Win32 does not securely handle the arguments passed to batch or command shell CGI programs. By crafting a CGI request containing the “|” (pipe) character, an attacker can cause the program to execute arbitrary commands with the privileges of the Apache process. By default, Apache is installed with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, all programs including Apache run with full privileges.

---

Impact

An unauthenticated, remote attacker could execute commands on the vulnerable server with the privileges of the Apache process. By default, Apache runs with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, Apache runs with full privileges.

---

Solution

Upgrade Apache
This vulnerability is resolved in Apache 1.3.24 and 2.0.34-beta. Please see the release Announcement for version 1.3.24. The Apache HTTP Server is available from the Apache web site.

---

Run Apache with User privileges

On Windows NT, 2000, and XP systems, the Apache service can be configured to run as a specified user instead of local SYSTEM. By carefully specifying the privileges of the Apache user, an administrator can restrict the ability of a CGI program to access files and execute commands.

---

Vendor Information

124003

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Apache __ Affected

Notified: April 08, 2002 Updated: April 11, 2002

Status

Affected

Vendor Statement

Apache has released versions 1.3.24 and 2.0.34-beta that address this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has verified this vulnerability on Apache 1.3.23 running on Windows 2000.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23124003 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.apache.org/dist/httpd/&gt;
• <http://www.apache.org/dist/httpd/CHANGES_1.3&gt;
• <http://www.apache.org/dist/httpd/Announcement.html&gt;
• <http://www.securityfocus.com/bid/4335&gt;
• <http://online.securityfocus.com/archive/1/263370&gt;
• <http://www.w3.org/CGI/&gt;
• <http://hoohoo.ncsa.uiuc.edu/cgi/&gt;

Acknowledgements

The CERT/CC acknowledges Ory Segal for reporting this vulnerability.

This document was written by Art Manion.

Other Information

CVE IDs:	CVE-2002-0061
Severity Metric:	11.06 Date Public: