Subject: Bug#3969: Apache 1.0.5 Security Hole

From: [email-masked]
Date: Tue, 30 Jul 1996 10:52:12 -0400

Package: apache
Version: 1.0.5-1

As previously mentioned by someone else for v1.0.3, the programs:
/var/web/cgi-bin/phf
and possibly
/var/web/cgi-bin/jj
are a serious security hole allowing anyone to run an arbitrary program as
the web server.  The best fix is to remove these programs completely, as they
are examples, second best is to remove their execute bits and/or move them
to the examples directory.  Recently a number of web sites have seen hits from
security.wood.com, apparently probing for this hole.  The CERT advisory
CA-96.06 discusses the vunerability in phf.

---

From: Miquel van Smoorenburg <[email-masked]>
Date: Wed, 31 Jul 1996 02:45:04 +0200 (MET DST)

> As previously mentioned by someone else for v1.0.3, the programs:

That someone was me.

> CA-96.06 discusses the vunerability in phf.

That was the reson why I made an interim release (1.0.5). These bugs
have been fixed in the 1.0.5 version.

And yes, you can still get a shell on 50% of the sites running apache since
most of them are still running <= 1.0.4. The same problem is present in
a lot of the NCSA servers, too.

Mike.
-- 
  Miquel van    | Cistron Internet Services   --    Alphen aan den Rijn.
  Smoorenburg,  | mailto:[email-masked]          http://www.cistron.nl/
[email-masked] | Tel: +31-172-419445 (Voice) 430979 (Fax) 442580 (Data)