Slashdot Mirror
Apache 2.0 r00ted on NetWare, Windows, OS/2
An anonymous reader writes "A flaw in Apache 2.0's interpretation of the backslash delimiter allows for a remote r00ting on NetWare, Windows, and OS/2. InfoWorld has an overview; the attack was discoverd by PivX's Auriemma Luigi, and he describes it in this technical document. I don't know whether there is such a thing as an OS/2 shop anymore, and most Microsoft shops probably run IIS, but Apache now ships as the default web server for NetWare 6, so Novell shops: Take note. A patch is available from Apache, and Luigi describes a workaround in his article."
Quite a few shops run windows Apache. Partly to reduce the rate at which they have to patch web servers.
First off, how can you get root on windows?
Second, What idiot runs apache as a superuser? If you do, you deserve what you get.
Cough, another repeat. http://apache.slashdot.org/article.pl?sid=02/08/10 /0058246&mode=thread&tid=148
This is because the software is most likely written on unix-based machine. They only port the software and make subtle changes to other OSes. Anyway, it's a good thing I'm running Linux.
Jonahweb.com has stuff.
Apache 2.0.40 was released August 9th, fixing the hole. You can read the advisory, but you should have upgraded already. The real news is that many Apache web servers are still unpatched. Won't admin's ever learn?
The bug only provides information about the target server, that's not a root exploit last time I checked. Also it's a repeat story
Move along. Nothing here
In SOVIET RUSSIA the hot grits profit you!
Not too many people would have this under OS/2. I haven't seen OS/2 used by web servers (except for certain OS/2 supporter sites), but I did see it just 2 or 3 weeks at a local ATM. I only knew it was OS/2 because it was crashed, and I remember the Trap screen well from when I used it on my system.
C:\>
...and Luigi describes a workaround in his article.
Mama mia!
Mario? MARIO!
Someone get that man a dustbuster, there's a mansion full of ghosts he should know about!
To emphasize: NOVELL SHOPS, TAKE HEED!
It is very rewarding to see a goat you have raised from a baby grow up and have kids and grandkids of her own. With goats that doesn't have to take too long, maybe about 3 or 4 years at most, because they are able to breed when they are just a year old. It's also neat to learn how to milk or trim hooves and other things that you wouldn't ordinarily be able to do.
The same homos who use the word "pr0n". That's what regualar exposure to the GNU/Linux philosophy will do to you... your speech changes, your sexual orientation changes, you stop taking baths, and you play with Legos all day.
What is the deal with NetWare, exactly?
:)
The term "Apache 2.0 r00ted on NetWare" implies that NetWare is an operating system- I was under the impression NetWare ran as a bunch of services on top of Win NT or something like that. Is that the case, or does NetWare run as an OS, directly on the hardware?
If it is the former, is there a special version of Apache that uses NetWare on top of Windows? If this is the case, I assume that it is using the IPX protocol instead of TCP/IP... what is the advantage of this? If it's not this, what is the difference? What makes Apache on NetWare different than Apache on Windows?
Any insight would be much appreciated-
Working toward a usable PDA environment in the spirit of Newton OS: Dynapad
The first bug was a "helpful" error message, giving you the _exact_ path of the apache installation, when asking for a file in the error-directory. This is really the kind of fault we expect from Microsoft (always trying to be more "user-friendly" then secure).
The second bug was even worse. Apache didn't interpret '\' as a "dangerous" character in urls. And neither was \..\..\..\WINNT\system32\ looked at as especially suspicious. With all the press nimda and code red got, it wouldn't be so hard to think that Apache wouldn't do the same mistake AFTER Microsoft, but did they do... Oh, yes...
In IIS, the final nail in the coffin when it comes to security is the fact that it runs under the privileges of SYSTEM. Anyone knows what Apache on NT/2k runs as?
I was just going to post that.
/. frontpage.
/.
This is supposed to be a place for sysadmins/developers/nerds/programmers/ect
Not some cracker BBS. What kind of a self respecting person would say "r00ted"?
Go ahead and downmod me, I don't care since I'm not posting under my real UID. But the fact of the matter is, it looks very fucking stupid and irresponsible allowing idiot kids post articles with stupid hax0r language on
I lost my faith in
Apache 2.0? It's been marked for release for months now. In fact, if you go to the Apache download page linked in the article header you'll see that they list 2.0.40 as the 'best available version'.
Bleh!
While I'm sure this will look like anti-MS propoganda, there are certain points to be made here. I have strong negative feelings about the quality of MS's security approach in (1) minimizing local break-in damage, (2) keeping software from having holes, (3) keeping software from being attacked, and (4) vendor bug response approach.
MINIMIZING BREAK-IN DAMAGE
Yes
Yes, services on Windows *can* run as all different users, a la UNIX -- I have ftp, pdnsd, apache, junkbust, squid, xfs, postfix, and sshd set up on my Linux box by default. However, in Windows, *usually*, and *by default* they don't.
Dunno whether Apache for Windows is set up as its own user by default, but most services for Windows don't take advantage of this. You could say that this isn't MS's fault, that there's just less of a multi-user culture around Windows than UNIX, but the fact is that Windows boxes are generally more vulnerable to full compromise in a break-in.
Second, Windows has no concept of "chroot". If I lock something in a chroot jail on UNIX, a hole in a server means next to nothing to me. You broke the server? The files served by the server had better be valuable in and of themself, since you can't get at or see anything else. This doesn't affect most out-of-box distros, since most distros don't go to the trouble of using chroot -- but sites that really value security do use chroot. On Windows, there is no such available option.
Basically, UNIX has a better ability to sandbox, and its capabilities are much more widely used than on Windows -- your average server software developer takes advantage of them on UNIX -- but not on Windows.
KEEPING APPLICATIONS FROM BEING BUGGY
This is a Windows-specific pathname issue. There have been more Windows-specific pathname exploits in Windows servers than I can count. The MS approach of having an extremely convoluted pathname system (particularly files having non-unique names with the backwards compatible 8.3 support) has led to many, many issues with servers. IIS has had numerous holes involving this, and it seems like just about every Windows FTP or Web server has suffered from this at one point or another.
Next, people often complain that UNIX doesn't have ACLs, whereas Windows does. ACLs seem really attractive -- a very easy way to do security work. The problem is that they are much more complicated, and orders of magnitude harder to audit for holes, than the minimalist UNIX security model. Most break-ins are not due to someone literally not having fine-grained enough security -- they're almost always the fault of misconfiguration, which a simpler security model makes massive improvements in. If anyone's every admined a VMS box, you know what I'm talking about -- trying to assure that your box has *no* routes for someone to gain control of the box can be interesting, despite VMS's very fine-grained security model.
Out of box Windows file and registry permissions still hurt the security of Windows boxes -- they aren't as insanely bad as in NT 4.0 out of box any more, but most application vendors are still living in a 9x world, and are focused on adding features, not on maintaining the security model.
Too many Windows subsystems break the Windows security model. I wouldn't trust DirectX and all the non-core stuff on Windows not to have holes -- any yet they post a threat to local security.
As mentioned a while ago in the "shatter attack" article on Slashdot, the windowing model for Windows that worked so well for writing GUI applications easily (well, easily compared to raw Xlib, though Lord knows gtk knocks Win32 into a cocked hat) isn't a very good system from a security standpoint.
KEEPING BUGGY APPLICATIONS FROM BEING ATTACKED
Linux has powerful (granted, not very easy to use, at least without a wrapper) firewalling/routing capabilities through iptables. If your box is ignoring everying from port 22 from outside the computers on your three-person-team at your company, it's rather harder to exploit, say, SSH buffer overflows, or even find a vulnerable server.
Windows has Zone Alarm (and probably other local firewalls, but this is definitely the popular one). Now, this is probably nice for a workstation, but it doesn't compare with iptables in performance, and it doesn't provide the level of control that iptables does. If my internal web server running Apache isn't exposed to people not in my workgroup, then there isn't going to be much exploitation of the server.
MS BUG RESPONSE APPROACH
It's not really all that fair to compare the "46 minute" response time of open-source developers to MS's response time. Yes, in extreme situations someone could get the patch and apply it, in cases of something like the Internet Worm II. Most companies are going to wait for their vendor, be it Red Hat or SuSE or whatever, to come out with a packaged, QAed and supported update. That being said, these fixes still usually come out before MS's fixes. Furthermore, MS eliminates a bunch of their quality guarantees that they provide on Service Packs when you're using HotFixes. Red Hat (at least -- I haven't checked with other vendors) doesn't do that. Their bugfixes are just as fully supported, just as guaranteed to roll back, as their release software. That means that their updates better compare to Service Packs, which take forever and a day to come out after an exploit. So MS usually takes a long time to fix bugs.
Also, MS's primary to-end-user bugfix distribution format is Windows Update. Windows Update is one of the least impressive update systems I've seen yet -- it's used to update system software, yet it relies on a huge amount of application and system software. If it screws up, you're dead. And I've had a number of unpleasant experiences with Windows Update failing one way or another -- for example, once I had a bluescreen on a reboot after updating and trying to run MSIE (keep in mind that this is an NT-line kernel, not 9x). I've seen error dialogs during updates, and other semi-disturbing blemishes. After two incidents where Windows Update rendered boxes unbootable, I've taken to not running Windows Update (even to fix security issues) unless I have a known free two days to reinstall the OS and get everything running wrinkle-free again if something goes hideously wrong.
Furthermore, because of the way Windows does file and DLL locking (stupid, stupid -- ever try moving/deleting/renaming an open file under Windows? Combined with Explorer sometimes leaking file handles, this is a royal PITA), low-level updates usually require a reboot. The only Linux update that requires a reboot is a kernel update (though updating a desktop environment or a WM requires logging out and back in again to see the changes). Finally, I've ripped out much of my RPM-based Linux system and put in back in (bits of different distros, bits of devel-branch software) and always had smooth moves, nothing that could make my system unbootable. I feel a lot more confident in an RPM installation or uninstallation than I do in a Windows update.
Anyway, just my two cents -- just wanted to point out that this issue can still be partly blamed on Windows security issues, and not wanting people to lose sight of the areas in which MS needs to improve.
May we never see th
Netware 6 ships with Apache 1.3.22 and Tomcat 3.3. It is NOT vulnerable to this particular exploit. Note that some Netware 6 services also uses the Netware-Enterprise-Web-Server 5.1 from defunct Novonyx, a joint effort of Novell and Netscape.
Now, Apache does offer a 2.x version that does also run on Netware. So, it is possible for someone to upgrade their Netware server from 1.3.22 to 2.x but, this is not how Novell ships it. Additionally, most Netware shops will take their updates only from Novell therefore, I would be surprised if there were many Apache 2.x servers running on Netware.
A month old repeat article is news?
The infoworld article is a month old.
Slashdot had it two weeks ago.
NetWare ships with Apache 1.3.x
Try to check your sources next time!
It does not require booking DOS before loading the netware kernel. You're thinking of 3.12 (a fantastic LAN NOS, by the way; still ahead of NT for file and print services in some ways).
Modern netware has a microkernel operating system. It runs TCP/IP natively (it has at least since 5). It also has the most robust directory server available. It's faster and more stable than ActiveDirectory and has been since the later 4 versions.
Unlike all the other posters in this thread, this person actually knows something about netware past the 3.x versions. One guy mentions that the last time he ran netware you booted to DOS to start it; haven't had to do that since 4.x (at lest 5 years ago).
Since you decided to get picky about this...
The "apostrophe S" construction in English initially came from the fact that English has two ways to indicate possession. The first is the word "of," for example, "the castle of the king." "I like the castle of the king."
This is a mouthful, so a shorter method developed: "the king his castle." I like the king his castle.
Over time, "his" atrophied into a single "s," much in the same fashion that "all right" is about to lose "ll r" and become "a'ight." The king his castle became "the king's castle." Yeah, it's sexist. This was the middle ages. Get over it.
Now, about that apostrophe. The apostrophe in English stands for something that has been dropped. What has been dropped in "the king his castle" is " hi." This is why we use the apostrophe.
So, since we seem to be in such a nitpicky mood today, when you write "administrators" as "admin's," the apostrophe is properly there to indicate the dropped letters. Indicating possession actually has nothing to do with it.
Yes, remember Stardock's Process Commander or the freeware program WatchCat? I was actually one of perhaps 1000 people that purchased Process Commander, but it actually worked. Stardock wrote a completely new keyboard driver that did not have the limitations of IBM's... Watchcat let you trigger it through a serial port and a switch, which I believe you had to make with help from your local Radio Shack.
I don't read or respond to AC posts
I'm a CNI, an MCNI, a CNE, an MCNE, blah blah blah, and I've never heard of running NetWare without SERVER.EXE.
Please expound.
The 68000 file servers were needed in the days when PCs weren't quite powerful enough to serve large networks.
Netware 6.0 comes with Apache 1.3 out of the box. In order to install Apache 2.0, you must follow strict instructions that explicitly warn you that the 2.0 code for Netware is highly experimental:
"Due to the fact that Apache 2.0 for NetWare has not received the same level of testing as on other platforms, the binaries for Apache 2.0 have been made available for testing purposes only. We DO NOT recommend that Apache 2.0 for NetWare be used in a production environment at this point."
See this for reference.
-bk