Its nice to see SuSE on top of things! Thanks guys for getting a fix out nice and quick! keep it up! : )) jason j a s o n wrote:

----------------------------------------------------------------------------------

Subject: [BUGTRAQ] @stake Advisory: SuSE Apache CGI Source Code Viewing (A090700-2) Date: Thu, 7 Sep 2000 11:50:46 -0400 From: "@stake Advisories" To: BUGTRAQ@SECURITYFOCUS.COM

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

@stake, Inc. www.atstake.com www.cerberus-infosec.co.uk

Security Advisory

Release Date: 09/07/2000 Application: Apache 1.3.9/12 Platform: SuSE Linux 6.3 and 6.4 Severity: An attacker can gain access to source code of CGI scripts. As such they may be able to discover user IDs and passwords, analyze business logic and examine scripts for weaknesses. Author: mnemonix (dlitchfield@atstake.com) Vendor Status: Vendor has updated distribution configuration files Web: www.atstake.com/research/advisories/2000/a090700-2.txt

Overview:

The SuSE distribution of Linux (6.3 and 6.4 - earlier distributions may also be affected) uses Apache as the web server of choice (currently 1.3.12 with SuSE 6.4) and is installed by default. Due to certain settings within the Apache configuration file it is possible for an attacker to gain access to the source code of CGI scripts. Often these scripts contain sensitive information such as user IDs and passwords for database access and business logic. Further to this, gaining access to the code can allow the attacker to examine the scripts for any weaknesses that they could then exploit to gain unauthorized access to the server.

Detailed Description:

Apache reads in its configuration information from a file called httpd.conf found in the /etc/httpd/ directory (srm.conf and access.conf have been rolled into httpd.conf). Due to an erroneous setting in this file it is possible to gain access to the source code of CGI scripts held in the virtual directory /cgi-bin/. Under normal operation files in this directory are executed on the server as opposed to being returned to the client. The setting in httpd.conf that allows execution of CGI scripts and sets the /cgi-bin as the script directory is:

ScriptAlias /cgi-bin/ "/usr/local/httpd/cgi-bin"

However, as well as this setting there is also another:

Alias /cgi-bin-sdb/ /usr/local/httpd/cgi-bin/

This line is the root of the problem. An alias, or virtual directory called "/cgi-bin-sdb/" has been set up and maps to the same physical location that the "/cgi-bin" has been mapped to. SuSE should have set this up as a "ScriptAlias" rather than just an "Alias". This alias exists to support searching through SuSE's documentation from the web server but as it transpires the search engine uses /cgi-bin, anyway - perhaps being the cause of the oversight. An attacker would simply substitute /cgi-bin/ for /cgi-bin-sdb/ to gain access to the source code.

Solution:

There are two ways to approach this. Using your favourite editor, e.g. pico or vi, edit httpd.conf. The alias can be removed by placing a # at the front of line - thus "remming" it out:

#Alias /cgi-bin-sdb/ /usr/local/httpd/cgi-bin/

As the search engine uses /cgi-bin this will not break any functionality. The other way of resolving this issue would be to change "Alias" to "ScriptAlias" so the line would read:

ScriptAlias /cgi-bin-sdb/ /usr/local/httpd/cgi-bin/

By doing this CGI scripts would now be executed. After making these changes stop and restart the server.

Vendor Response:

SuSE has updated the Apache distribution package. More information can be found at http://www.suse.de/de/support/security/

For more advisories: http://www.atstake.com/research/index.html PGP Key: http://www.atstake.com/research/pgp_key.asc

Copyright 2000 @stake, Inc. All rights reserved.

-----BEGIN PGP SIGNATURE----- Version: PGP 6.5.8

iQA/AwUBObe21lESXwDtLdMhEQJajwCg8kYY9NZH7zKaXRYRtTp0kVAcY5kAn3Cs cRQt/QyJI1Ol8KtGkeYg60vM =3+wu -----END PGP SIGNATURE-----

---------------------------------------------------------------------------------- --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com