STG Security Advisory: [SSA-20040217-06] Apache for cygwin directory

traversal vulnerability



Revision 1.0

Date Published: 2004-02-17 (KST)

Last Update: 2004-02-17

Disclosed by SSR Team (advisory@stgsecurity.com) 





Abstract

========

Apache on cygwin environment has a directory traversal vulnerability.



Vulnerability Class

===================

Implementation Error: Input validation flaw



Details

=======

Apache httpd on cygwin environment has a directory traversal vulnerability

similar to a reported bug in

http://cert.uni-stuttgart.de/archive/bugtraq/2002/08/msg00241.html 



Using the following code, a malicious user can retrieve any file.

http://[server]/..%5C..%5C..%5C..%5C..%5C..%5C/boot.ini 



Impact

======

File disclosure



Solution

=========

Stipe Tolj, Apache for cygwin maintainer, released a patch file to fix this

vulnerability on Apache 1.3.29 as shown in the following URL.



http://nagoya.apache.org/bugzilla/show_bug.cgi?id=26152 



Apache 2 on the cygwin, however, is still vulnerable and is recommended not

to use it for a production server.



Affected Products

================

Apache 1.3.29 and below

Apache 2.0.48 and below



Vendor Status: FIXED

=======================

2004-01-13 Jeremy Bae found the vulnerabilities.

2004-01-15 Apache project notified.

2004-02-03 Cygwin platform maintainer confirmed.

2004-02-04 A patch file released.

2004-02-17 Official release.



Credits

======

Jeremy Bae at STG Security