Vulnerability Development mailing list archives

Re: Apache Exploit

From: David Bernick <bernz () alpha bernztech org>
Date: Fri, 21 Jun 2002 23:57:41 -0400 (EDT)

In one case (the RH box), it looked like a TCP lockup condition. The thing
just stopped responding to outside stimuli, and right after that, inputs
via the local keyboard stopped as well. I haven't had time to dig into it 
further.


I've tested the Gobbles 'sploit against the following machines/platforms:
1. RH Linux 6.1 w Apache 1.2.x PIII 512MB
2. RH Linux 7.2 w Apache 1.3.24 PIII 512MB
3. RH Linux 7.2 w/Tux Webserver PII 128MB
4. RH Linux 7.2 w Apache 1.3.26 DualPIII 1GB
5. RH Liunx 6.1 w Apache 1.3.14 on an Alpha processor 512MB

After 1 full day of running the gobbles code in Brute Force mode, I've
found that the Tux server wouldn't even accept the Chunked encoding so
that seems to pose no threat. 
On server 1,2 and 5, I have yet to spawn a rootshell, but a single client
takes up considerable resources on the target machine. Not enough to DOS
any of the boxes effectively, though I imagine a distributed or multiple
client attack would have no problem doing this effectively. A single
client nearly used up all the RAM on most machines and forced it to start
using Swap space. I don't know if this is a garbage collection issue on
Linux, but just doing a Heavy Load test on this machines barely makes it
budge, so it probably has something to do with the exploit. On machine 4,
with the new Apache, the only concern is that there is still an error
thrown in the logs, and that could lead to disk filling attacks, but I
doubt that someone could fill it fast enough to disrupt any large disk. 

On the machines that are vulnerable, they register a segmentation fault
on the child processes. The following log is shown:

<snip>
[Fri Jun 21 21:05:51 2002] [notice] child pid 20720 exit signal
Segmentation fault (11)
[Fri Jun 21 21:05:51 2002] [notice] child pid 20719 exit signal
Segmentation fault (11)
[Fri Jun 21 21:05:51 2002] [notice] child pid 20718 exit signal
Segmentation fault (11)
<snip>
notice the times. And that's with a single client attacking. Scary. Easy
to coordinate this into a DDOS, I think.

at the moment, but I recall the web server complaining about a misplaced
colon character or something. The DoS came from having only one partition


this is the message he's talking about:

<TITLE>400 Bad Request</TITLE>
</HEAD><BODY>
<H1>Bad Request</H1>
Your browser sent a request that this server could not understand.<P>
Request header field is missing colon separator.<P>


-- 
David Bernick
bernz () bernztech org

Rarely do people communicate; they just take turns talking.

Current thread:

Apache Exploit Stefan Esser (Jun 20)
- Re: Apache Exploit Blue Boar (Jun 20)
  - Re: Apache Exploit Randy Taylor (Jun 20)
    - Re: Apache Exploit Michal Zalewski (Jun 20)
    - Message not available
    - Re: Apache Exploit Randy Taylor (Jun 21)
    - Re: Apache Exploit David Bernick (Jun 21)
    - Re: Apache Exploit T0aD (Jun 22)
    - Re: Apache Exploit Alex Balayan (Jun 23)
    - Re: Apache Exploit Randy Taylor (Jun 24)
    - Re[2]: Apache Exploit dullien (Jun 26)
- Re: Apache Exploit 3APA3A (Jun 20)
  - Re: Apache Exploit Stefan Esser (Jun 20)
  - Re[2]: Apache Exploit dullien (Jun 20)
    - Re[2]: Apache Exploit Michal Zalewski (Jun 20)
    - Re: Apache Exploit Jefferson Ogata (Jun 20)
    - Re: Apache Exploit Michal Zalewski (Jun 21)

(Thread continues...)