Penetration Testing: RE: Apache Chunked Encoding Vulnerability on AIX (RS6000)

From: Benninghoff, John <John.Benninghoff_at_Rbcdain.com>
Date: Tue, 13 Aug 2002 13:03:15 -0500

IBM's Apache-derived HTTP server is vulnerable to attack, although I know of no publicly available exploit code. At one point, it was claimed that the Chunked Encoding bug was only exploitable on some systems, but this has been shown to be untrue.

IBM has issued a fix for the flaw.

-----Original Message-----
From: r00t_at_online.ie [mailto:r00t_at_online.ie]
Sent: Tuesday, August 13, 2002 7:10 AM
To: pen-test_at_securityfocus.com
Subject: Apache Chunked Encoding Vulnerability on AIX (RS6000)

Hi All,

I am currently pen-testing an AIX platform, which utilises Apache and IBM HTTP
server in order to communicate with a back-end AS400 enviornment.

I have scanned the remote host with the eeye tool Retina - Apache Chunked
scanner V 1,0,3, which reports the host vulnerable.

It would appear the tool attempts to exploit the vulnerability by attempting to
send a small request that makes a vulnerable server to become unresponsive.

Would I be right to say that this vulnerability is not exploitable on an RS6000
platform, given the current exploits in the wild, and the eeye tool is again
producing false positives ????????

Any help is very much appreciated.

Thanks in advance.

./Mark

PS: SF Bid number = BID 5033

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/