Vulnerability Note VU#124003

Apache HTTP Server on Win32 systems does not securely handle input passed to CGI programs

Overview

A vulnerability in the Apache HTTP Server running on Win32 systems (Windows 9x/Me, Windows NT/2000/XP) could allow an attacker to execute commands with the privileges of the web server process.

I. Description

The Apache HTTP Server is a freely available web server that runs on a variety of operating systems including Unix, Linux, and Microsoft Windows (Win32). Apache supports the Common Gateway Interface (CGI) that defines a standard interface between the HTTP server and external applications. On Win32 systems, batch or command shell programs (files typically with .bat or .cmd extensions) can be executed via the CGI interface, and these programs are executed within a full command shell (command.com on Windows 9x/Me, cmd.exe in Windows NT/2000/XP).

Ory Segal of Sanctum has reported a vulnerability in which Apache on Win32 does not securely handle the arguments passed to batch or command shell CGI programs. By crafting a CGI request containing the "|" (pipe) character, an attacker can cause the program to execute arbitrary commands with the privileges of the Apache process. By default, Apache is installed with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, all programs including Apache run with full privileges.

II. Impact

An unauthenticated, remote attacker could execute commands on the vulnerable server with the privileges of the Apache process. By default, Apache runs with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, Apache runs with full privileges.

III. Solution

Upgrade Apache

This vulnerability is resolved in Apache 1.3.24 and 2.0.34-beta. Please see the release Announcement for version 1.3.24. The Apache HTTP Server is available from the Apache web site.

Run Apache with User privileges

On Windows NT, 2000, and XP systems, the Apache service can be configured to run as a specified user instead of local SYSTEM. By carefully specifying the privileges of the Apache user, an administrator can restrict the ability of a CGI program to access files and execute commands.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apache	Vulnerable	11-Apr-2002

References

http://www.apache.org/dist/httpd/
http://www.apache.org/dist/httpd/CHANGES_1.3
http://www.apache.org/dist/httpd/Announcement.html
http://www.securityfocus.com/bid/4335
http://online.securityfocus.com/archive/1/263370
http://www.w3.org/CGI/
http://hoohoo.ncsa.uiuc.edu/cgi/

Credit

The CERT/CC acknowledges Ory Segal for reporting this vulnerability.

This document was written by Art Manion.

Other Information

Date Public:	2002-03-21
Date First Published:	2002-04-11
Date Last Updated:	2002-05-28
CERT Advisory:
CVE-ID(s):	CAN-2002-0061
NVD-ID(s):	CAN-2002-0061
US-CERT Technical Alerts:
Severity Metric:	11.06
Document Revision:	18

If you have feedback, comments, or additional information about this vulnerability, please send us email.