Software Engineering Institute

Notified:  June 14, 2002 Updated: July 08, 2002

Status

Unknown

Vendor Statement

Cisco Systems is evaluating the vulnerabilities identified by VU#944335. Should an issue be found, Cisco will release a Security Advisory. The most up-to-date information on all Cisco product security issues may be found at

http://www.cisco.com/go/psirt/

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  June 14, 2002 Updated: June 27, 2002

Status

Unknown

Vendor Statement

Nortel Networks is reviewing its portfolio to determine if any products are affected by the vulnerability noted in CERT Advisory CA-2002-17. A definitive statement will be issued shortly.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  June 14, 2002 Updated: July 15, 2002

Status

Unknown

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________
                          SGI Security Advisory

         Title:  Apache Web Server Chunk Handling vulnerability
       Number:  20020605-01-I
         Date:  July 12, 2002
    Reference:  SGI Security Advisory 20020605-01-A
    Reference:  CERT CA-2002-17
    Reference:  Apache Security Bulletin 20020617
    Reference:  CAN-2002-0392
______________________________________________________________________________


- -----------------------
- --- Issue Specifics ---
- -----------------------

This bulletin is an update to SGI Security Advisory 20020605-01-A.

It has been reported that versions of the Apache web server up to and
including 1.3.24 and 2.0 up to and including 2.0.36 contain a bug in the
routines which deal with invalid requests which are encoded using chunked
encoding.  This bug can be triggered remotely by sending a carefully crafted
invalid request. This functionality is enabled by default.

See http://httpd.apache.org/info/security_bulletin_20020617.txt for
additional details.

SGI has investigated the issues and recommends the following steps for
neutralizing the exposure.  It is HIGHLY RECOMMENDED that these measures be
implemented on ALL vulnerable SGI systems.

These issues have been corrected in IRIX 6.5.17, where we are now supplying
a fixed version of Apache.  We are also making the fixed version of Apache
available on our security FTP site for prior releases of IRIX.


- --------------
- --- Impact ---
- --------------

The Apache webserver is supplied with IRIX versions since 6.5.12m/f as a
replacement for the older SGI FastTrack server.  It is installed by default,
and is enabled through "chkconfig" by default.

In order to determine if the Apache webserver is installed, execute the
following command:

  # versions -b | grep apache

If the following line is returned you are OK:

I  sgi_apache           07/10/2002  SGI Web Server based on Apache, 1.3.26

But if either of these are returned you are vulnerable:

I  sgi_apache           03/20/2001  SGI Apache Server, 1.3.17
I  sgi_apache           06/10/2001  SGI Apache Server, 1.3.20
I  sgi_apache           12/06/2001  SGI Web Server based on Apache, 1.3.22

These vulnerabilities might lead to a root compromise in some
configurations, and no local account is required.

These vulnerabilities have been publicly discussed in Usenet newsgroups
and mailing lists.

This vulnerability was assigned the following CVE:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0392


- ----------------------------
- --- Temporary Workaround ---
- ----------------------------

SGI acknowledges that it may not always be possible to immediately install
patches or upgrade the operating system.  In those cases, we recommend
removing the Apache webserver and associated products by using the following
commands:

  # versions remove sgi_apache\*
 # versions remove websetup\*
 # versions remove gateway\*

It is not necessary to reboot the system after doing this.  You should
upgrade the operating system as soon as it is possible to do so.


- ----------------
- --- Solution ---
- ----------------

SGI has not provided a patch for these issues, but instead has rolled the
fixed Apache distribution into IRIX 6.5.17 and later releases of the
operating system.

   OS Version     Vulnerable?     Patch #      Other Actions
  ----------     -----------     -------      -------------
  IRIX 3.x          no                        Note 1
  IRIX 4.x          no                        Note 1
  IRIX 5.x          no                        Note 1
  IRIX 6.0.x        no                        Note 1
  IRIX 6.1          no                        Note 1
  IRIX 6.2          no                        Note 1
  IRIX 6.3          no                        Note 1
  IRIX 6.4          no                        Note 1
  IRIX 6.5          no                        Note 2
  IRIX 6.5.1        no                        Note 2
  IRIX 6.5.2        no                        Note 2
  IRIX 6.5.3        no                        Note 2
  IRIX 6.5.4        no                        Note 2
  IRIX 6.5.5        no                        Note 2
  IRIX 6.5.6        no                        Note 2
  IRIX 6.5.7        no                        Note 2
  IRIX 6.5.8        no                        Note 2
  IRIX 6.5.9        no                        Note 2
  IRIX 6.5.10       no                        Note 2
  IRIX 6.5.11       no                        Note 2
  IRIX 6.5.12       yes                       Note 2
  IRIX 6.5.13       yes   sgi_apache 1.3.26   Note 2 & 3
  IRIX 6.5.14       yes   sgi_apache 1.3.26   Note 2 & 3
  IRIX 6.5.15       yes   sgi_apache 1.3.26   Note 2 & 3
  IRIX 6.5.16       yes   sgi_apache 1.3.26   Note 2 & 3
  IRIX 6.5.17       no


   NOTES

     1) This version of the IRIX operating has been retired. Upgrade to an
       actively supported IRIX operating system.  See
       http://support.sgi.com/irix/news/index.html#policy for more
       information.

     2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact your
       SGI Support Provider or URL: http://support.sgi.com/irix/swupdates/

     3) Install sgi_apache 1.3.26 which is supplied with the IRIX 6.5.17
       Applications CD or available as sgi_apache-1.3.26.tar from:
       ftp://patches.sgi.com/support/free/security/patches/{6.5.13-6.5.16}


                ##### Patch File Checksums ####

The actual patch will be a tar file containing the following files:

Filename:                 sgi_apache
Algorithm #1 (sum -r):    24080 5 sgi_apache
Algorithm #2 (sum):       37968 5 sgi_apache
MD5 checksum:             1EE81B8F7A8DF9ED4D9AF507EA1D2755

Filename:                 sgi_apache.books
Algorithm #1 (sum -r):    65292 3274 sgi_apache.books
Algorithm #2 (sum):       32822 3274 sgi_apache.books
MD5 checksum:             CD6296A58A1B6F1FF2D6B212058D1C4D

Filename:                 sgi_apache.idb
Algorithm #1 (sum -r):    13477 281 sgi_apache.idb
Algorithm #2 (sum):       4276 281 sgi_apache.idb
MD5 checksum:             3144B64008FF66BF858434208C6BCB5B

Filename:                 sgi_apache.man
Algorithm #1 (sum -r):    29483 97 sgi_apache.man
Algorithm #2 (sum):       35420 97 sgi_apache.man
MD5 checksum:             A7864555852DB7ACC913F049BFC46121

Filename:                 sgi_apache.src
Algorithm #1 (sum -r):    43010 6244 sgi_apache.src
Algorithm #2 (sum):       58317 6244 sgi_apache.src
MD5 checksum:             7D2A6A9A226327D8D9990F80635AED80

Filename:                 sgi_apache.sw
Algorithm #1 (sum -r):    20406 1852 sgi_apache.sw
Algorithm #2 (sum):       32509 1852 sgi_apache.sw
MD5 checksum:             371625EE5B321A76137AD1A18B23B4C0


- -------------------
- --- Information ---
- -------------------

SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/

SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/

SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/irix/ and ftp://patches.sgi.com/

SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/

SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/

SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/linux/ or
http://oss.sgi.com/projects/sgilinux-combined/download/security-fixes/

SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/nt/

IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/irix/ and ftp://patches.sgi.com/support/patchset/

IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/colls/patches/tools/relstream/index.html

IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/irix/swupdates/

The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com (216.32.174.211).  Security advisories and patches are
located under the URL ftp://patches.sgi.com/support/free/security/

For security and patch management reasons, ftp.sgi.com (mirrors
patches.sgi.com security FTP repository) lags behind and does not do a
real-time update.


- ------------------------
- --- Acknowledgments ----
- ------------------------

SGI wishes to thank Mark Litchfield, CERT, ISS and the users of the Internet
Community at large for their assistance in this matter.


- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------

If there are questions about this document, email can be sent to
security-info@sgi.com.

                      ------oOo------

SGI provides security information and patches for use by the entire SGI
community.  This information is freely available to any person needing the
information and is available via anonymous FTP and the Web.

The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com (216.32.174.211).  Security advisories and patches are
located under the URL ftp://patches.sgi.com/support/free/security/

The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/

For issues with the patches on the FTP sites, email can be sent to
security-info@sgi.com.

For assistance obtaining or working with security patches, please
contact your SGI support provider.

                      ------oOo------

SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email) all
SGI Security Advisories when they are released. Subscribing to the mailing
list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html) or by sending email to
SGI as outlined below.

% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress>
end
^d

In the example above, <YourEmailAddress> is the email address that you wish
the mailing list information sent to.  The word end must be on a separate
line to indicate the end of the body of the message. The control-d (^d) is
used to indicate to the mail program that you are finished composing the
mail message.


                      ------oOo------

SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .

                      ------oOo------

If there are general security questions on SGI systems, email can be sent to
security-info@sgi.com.

For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider.  A support
contract is not required for submitting a security report.

______________________________________________________________________________
     This information is provided freely to all interested parties
     and may be redistributed provided that it is not altered in any
     way, SGI is appropriately credited and the document retains and
     includes its valid PGP signature.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPS+/UrQ4cFApAP75AQHVJgQApjJG7ZUFT3S/wE7p1khZUiSxBpo1r0qc
inVeNOm1LskJAcr12rVpoKxAvl5UQA1AxeBuDJj1Om5DDN4jHI7mHbTGey4ZdFpJ
6TaewGXadi5xIW75Xh5dFnGYtmRCRSpekSt6VJzVmeYYocmkZyZ/VUjjDo2187Cv
o2LTSqrYsow=
=1pxh
-----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

An SGI Advisory describing this issue is available at:

ftp://patches.sgi.com/support/free/security/advisories/20020605-01-A

ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I

If you have feedback, comments, or additional information about this vulnerability, please send us email.