[security-alerts] FW: [SA21490] Apache "mod_alias" URL Validation Canonicalization Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> TITLE:
> Apache "mod_alias" URL Validation Canonicalization Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA21490
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/21490/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Security Bypass, Exposure of sensitive information
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Apache 2.2.x
> http://secunia.com/product/9633/
> Apache 2.0.x
> http://secunia.com/product/73/
> 
> DESCRIPTION:
> Susam Pal has discovered a vulnerability in Apache, which can be
> exploited by malicious people to bypass certain security restrictions
> and disclose potentially sensitive information.
> 
> The vulnerability is caused due to an canonicalization error in the
> "mod_alias" module in the handling of case-sensitive alias directive
> arguments on file systems supporting case-insensitive directory
> names. This can e.g. be exploited to disclose the source code of
> applications placed in the "cgi-bin" directory on certain non-default
> configurations where the ScriptAlias directive references a directory
> inside the document root by accessing an URL with a capital directory
> name (e.g. "CGI-BIN").
> 
> Example of a vulnerable configuration:
> DocumentRoot "[path]/docroot/"
> ScriptAlias /cgi-bin/ "/[path]/docroot/cgi-bin"
> 
> NOTE: This only affects the Microsoft Windows platform.
> 
> The vulnerability has been confirmed in versions 2.0.59 and 2.2.3,
> and has also been reported in version 2.2.2. Other versions may also
> be affected.
> 
> SOLUTION:
> Edit the configuration to ensure that alias directives (e.g.
> ScriptAlias) references directories outside of the document root.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Susam Pal, Infosys Technologies Ltd.
>