Software Engineering Institute

The Apache HTTP Server is a freely available web server that runs on a variety of operating systems including Unix, Linux, and Microsoft Windows (Win32). Apache supports the Common Gateway Interface (CGI) that defines a standard interface between the HTTP server and external applications. On Win32 systems, batch or command shell programs (files typically with .bat or .cmd extensions) can be executed via the CGI interface, and these programs are executed within a full command shell (command.com on Windows 9x/Me, cmd.exe in Windows NT/2000/XP).

Ory Segal of Sanctum has reported a vulnerability in which Apache on Win32 does not securely handle the arguments passed to batch or command shell CGI programs. By crafting a CGI request containing the "|" (pipe) character, an attacker can cause the program to execute arbitrary commands with the privileges of the Apache process. By default, Apache is installed with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, all programs including Apache run with full privileges.

An unauthenticated, remote attacker could execute commands on the vulnerable server with the privileges of the Apache process. By default, Apache runs with local SYSTEM privileges in Windows NT, 2000, and XP. In Windows 9x/Me, Apache runs with full privileges.

Upgrade Apache
This vulnerability is resolved in Apache 1.3.24 and 2.0.34-beta. Please see the release Announcement for version 1.3.24. The Apache HTTP Server is available from the Apache web site.

Run Apache with User privileges

On Windows NT, 2000, and XP systems, the Apache service can be configured to run as a specified user instead of local SYSTEM. By carefully specifying the privileges of the Apache user, an administrator can restrict the ability of a CGI program to access files and execute commands.