int(2615)

Boletines de Vulnerabilidades

Vulnerabilidad Cross-Site Scripting en cabecera Expect de Apache y de IBM HTTP Server

Clasificación de la vulnerabilidad
Propiedad Valor
Nivel de Confianza Oficial
Impacto Aumento de la visibilidad
Dificultad Principiante
Requerimientos del atacante Acceso remoto sin cuenta a un servicio estandar

Información sobre el sistema
Propiedad Valor
Fabricante afectado GNU/Linux
Software afectado IBM HTTP Server 6.0 < 6.0.2.13
IBM HTTP Server 6.1 < 6.1.0.1
Apache HTTP Server 1.3 < 1.3.35
Apache HTTP Server 2.0 < 2.0.58
Apache HTTP Server 2.2 < 2.2.2

Descripción
Se ha descubierto una vulnerabilidad en IBM HTTP Server 6.0 versión anterior 6.0.2.13 y 6.1 versión anterior 6.1.0.1, y Apache HTTP Server 1.3 versión anterior 1.3.35, 2.0 versión anterior 2.0.58, y 2.2 versión anterior 2.2.2. La vulnerabilidad reside en que en "http_protocol.c" no se valida la salida de la cabecera Expect cuando se refleja en un mensaje de error.

Un atacante remoto podría ejecutar código HTML y Web script arbitrarios para realizar ataques cross-site scripting (XSS) usando componentes Web clientes que puedan enviar cabeceras arbitrarias en peticiones, como ficheros Flash SWF.

Solución


Actualización de software

Red Hat
Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Linux Advanced Workstation 2.1 Itanium
https://rhn.redhat.com/

IBM
IBM HTTP Server 6.1 / 6.1.0.2
IBM HTTP Server 6.0 / 6.0.2.13
IBM HTTP Server 2.0 / PK25355
IBM HTTP Server 1.3 / PK27875
http://www-03.ibm.com/servers/eserver/support/unixservers/aixfixes.html

SGI
Advanced Linux Environment 3 / RPM / Patch 10326
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/RPMS
Advanced Linux Environment 3 / SRPM / Patch 10326
ftp://oss.sgi.com/projects/sgi_propack/download/3/updates/SRPMS

Debian Linux

Debian Linux 3.1
Source
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3.dsc
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3.diff.gz
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33.orig.tar.gz
Architecture independent
http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.33-6sarge3_all.deb
http://security.debian.org/pool/updates/main/a/apache/apache-doc_1.3.33-6sarge3_all.deb
http://security.debian.org/pool/updates/main/a/apache/apache-utils_1.3.33-6sarge3_all.deb
Alpha architecture
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_alpha.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_alpha.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_alpha.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_alpha.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_alpha.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_alpha.deb
AMD64
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_amd64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_amd64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_amd64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_amd64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_amd64.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_amd64.deb
ARM
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_arm.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_arm.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_arm.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_arm.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_arm.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_arm.deb
HP Precision
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_hppa.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_hppa.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_hppa.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_hppa.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_hppa.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_hppa.deb
Intel IA-32
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_i386.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_i386.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_i386.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_i386.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_i386.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_i386.deb
Intel IA-64
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_ia64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_ia64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_ia64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_ia64.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_ia64.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_ia64.deb
Motorola 680x0
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_m68k.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_m68k.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_m68k.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_m68k.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_m68k.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_m68k.deb
Big endian MIPS
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_mips.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_mips.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_mips.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_mips.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_mips.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_mips.deb
Little endian MIPS
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_mipsel.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_mipsel.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_mipsel.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_mipsel.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_mipsel.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_mipsel.deb
PowerPC
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_powerpc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_powerpc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_powerpc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_powerpc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_powerpc.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_powerpc.deb
IBM S/390
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_s390.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_s390.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_s390.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_s390.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_s390.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_s390.deb
Sun Sparc
http://security.debian.org/pool/updates/main/a/apache/apache_1.3.33-6sarge3_sparc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.33-6sarge3_sparc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-dbg_1.3.33-6sarge3_sparc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-perl_1.3.33-6sarge3_sparc.deb
http://security.debian.org/pool/updates/main/a/apache/apache-ssl_1.3.33-6sarge3_sparc.deb
http://security.debian.org/pool/updates/main/a/apache/libapache-mod-perl_1.29.0.3-6sarge3_sparc.deb

Suse Linux
Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux

Red Hat Linux (apache)
Red Hat Stronghold for Enterprise Linux
https://rhn.redhat.com/

OpenBSD
OpenBSD 3.8
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.8/common/017_httpd2.patch
OpenBSD 3.9
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.9/common/012_httpd2.patch
OpenBSD 4.0
ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.0/common/001_httpd.patch

Suse Linux
Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux.

Identificadores estándar
Propiedad Valor
CVE CVE-2006-3918
BID

Recursos adicionales
Apache Revision 394965
http://svn.apache.org/viewvc?view=rev&revision=394965

IBM PK24631: HTTP EXPECT HEADER VALUE CAN BE ECHOED TO BROWSER UNESCAPED
http://www-1.ibm.com/support/docview.wss?uid=swg1PK24631

SGI Security Advisory (20060801-01-P)
ftp://patches.sgi.com/support/free/security/advisories/20060801-01-P.asc

Debian Security Advisory DSA 1167-1
http://lists.debian.org/debian-security-announce/debian-security-announce-2006/msg00257.html

SUSE Security Advisory (SUSE-SA:2006:051)
http://www.novell.com/linux/security/advisories/2006_51_apache.html

Red Hat Security Advisory RHSA-2006:0692-4
https://rhn.redhat.com/errata/RHSA-2006-0692.html

OpenBSD Security Advisory October 7, 2006 (12)
http://www.openbsd.org/errata.html#httpd2

OpenBSD Security Advisory October 7, 2006 (17)
http://www.openbsd.org/errata38.html#httpd2

OpenBSD Security Advisory November 4, 2006 (01)
http://www.openbsd.org/errata.html#systrace

SUSE Security Advisory (SUSE-SA:2008:021)
http://www.novell.com/linux/security/advisories/2008_21_apache.html

Histórico de versiones
Versión Comentario Fecha
1.0 Aviso emitido 2006-08-09
1.1 Aviso emitido por SGI (20060801-01-P) 2006-08-28
1.2 Aviso emitido por Debian (DSA 1167-1) 2006-09-05
1.3 Aviso emitido por Suse (SUSE-SA:2006:051) 2006-09-12
1.4 Aviso emitido por Red Hat (RHSA-2006:0692-4) 2006-10-04
1.5 Aviso emitido por OpenBSD (October 7, 2006) 2006-10-16
1.6 Aviso emitido por OpenBSD (November 4, 2006) 2006-11-06
1.7 Aviso emitido por Suse (SUSE-SA:2008:021) 2008-04-15

Miembros de

CERT
FIRST
TF-CSIRT
EGC Group
UE
Red Nacional de SOC
Foro Nacional de Ciberseguridad
CSIRT.es
Ministerio de Defensa
CNI
CCN
CCN-CERT