Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3854
bozohttpd receives security update
13 December 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: bozohttpd
Publisher: NetBSD
Operating System: NetBSD
Solaris
FreeBSD
Linux variants
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
Original Bulletin:
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2018-009.txt.asc
Comment: This advisory references vulnerabilities in products which run on
platforms other than NetBSD. It is recommended that administrators
running bozohttpd check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
NetBSD Security Advisory 2018-009
=================================
Topic: bozohttpd can allow access to .htpasswd
Version: NetBSD-current: prior to 2018-11-22
NetBSD 8*: affected
NetBSD 7.2*: affected
NetBSD 7.1*: affected
pkgsrc: bozohttpd package prior to 20181123
Severity: Remote access to encrypted passwords and usernames
Fixed: NetBSD-current: November 21, 2018
NetBSD-8 branch: November 24, 2018
NetBSD-7-2 branch: November 24, 2018
NetBSD-7-1 branch: November 24, 2018
pkgsrc-current: bozohttpd-20181123 corrects this issue
Please note that NetBSD releases prior to 7.1 are no longer supported.
It is recommended that all users upgrade to a supported release.
Abstract
========
Under certain circumstances bozohttpd(8) can be tricked into revealing
the contents of certain special files. These special files are
configuration files for bozohttpd(8) and include the standard .htpasswd
file for HTTP Basic Authorisation (RFC-7617), which contains both a
list of user names and their encrypted passwords.
Technical Details
=================
There were two problems in the handling of bozohttpd special files. The
first was a missing check against .htpasswd itself in some cases, which
would allow access to the encrypted passwords and username to be seen for
the top-level directory. Any empty top-level directory name elided the
check for any special files. All requests now check special files.
The second was lack of short circuit when the error was detected. The
error would be returned, but instead of closing the connection, the
contents of the requested file was also returned. This was caused by
not checking the return value of bozo_check_special_files(). This
function is now marked with the "warn_unused_result" attribute.
Solutions and Workarounds
=========================
Users of any bozohttpd(8) features using special files should be upgraded
to bozohttpd 20181123 or later. There is no workaround except for not
using these features, which may mean simply disabling parts of the served
tree until the server is upgraded. Consider changing all the passwords used
in the .htpasswd as they may be compromised.
To apply a fixed version from a releng build, fetch a fitting base.tgz
from nyftp.netbsd.org and extract the fixed binaries:
cd /var/tmp
ftp http://nyftp.netbsd.org/pub/NetBSD-daily/REL/BUILD/ARCH/binary/sets/base.tgz
cd /
tar xzpf /var/tmp/base.tgz ./usr/libexec/httpd
with the following replacements:
REL = the release version you are using
BUILD = the source date of the build. 20181125* and later will fit
ARCH = your system's architecture
The following instructions describe how to upgrade your bozohttpd
binaries by updating your source tree and rebuilding and installing
a new version of bozohttpd.
* NetBSD-current:
Systems running NetBSD-current dated from before 2018-11-21
should be upgraded to NetBSD-current dated 2018-11-22 or later.
The following files/directories need to be updated from the
netbsd-current CVS branch (aka HEAD):
src/libexec/httpd
To update from CVS, re-build, and re-install bozohttpd:
# cd src
# cvs update -r netbsd-8 -d -P src/libexec/httpd
# cd src/libexec/httpd
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 8.*:
Systems running NetBSD 8.* sources dated from before
2018-11-24 should be upgraded from NetBSD 8.* sources dated
2018-11-25 or later.
The following files/directories need to be updated from the
netbsd-8 branche:
src/libexec/httpd
To update from CVS, re-build, and re-install bozohttpd:
# cd src
# cvs update -r netbsd-8 -d -P src/libexec/httpd
# cd src/libexec/httpd
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
* NetBSD 7.*:
Systems running NetBSD 7.* sources dated from before
2018-11-24 should be upgraded from NetBSD 7.* sources dated
2018-11-25 or later.
The following files/directories need to be updated from the
netbsd-7, netbsd-7-2 or netbsd-7-1 branches:
src/libexec/httpd
To update from CVS, re-build, and re-install bozohttpd:
# cd src
# cvs update -r <branch_name> -d -P src/libexec/httpd
# cd src/libexec/httpd
# make USETOOLS=no cleandir dependall
# make USETOOLS=no install
Thanks To
=========
Thanks to JP for reporting this issue and helping find the problematic code.
Thanks to Matthew Green for fixing this and other DoS issues reported by JP.
Revision History
================
2018-12-11 Initial release
More Information
================
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
http://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2018-009.txt.asc
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ .
Copyright 2018, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
- -----BEGIN PGP SIGNATURE-----
iQIcBAEBAgAGBQJcD89UAAoJEAZJc6xMSnBuYZkP/2+xBFItowBMvEPuoJhwE6rH
MRa/K+IqDRkJwJXvcbDXBVthXWVCFieYQYCxTz4rSeVPS1wBI81k7P6p2Bh9IwIh
JcespXvf111gAp6BlHRju2WJ9dYMsw1E6HjWA2C4SvZ6+wdo3gVgxyoX2nL2P7cb
jwFOiCDDKqUFvL0NRB2fF1lqQM5y/AW2uFqeGXn7PgwZBnNg7GBH5Ar7Hxe16cGo
BaI+O37jkjziY9Fle5FY0EndWtmk8BKIDX9oHy+ONWp791ZY7uLBfLCoW3bUGcLY
cqp65J+xSGH0vsY9zRsdIVw9GHdpTgSYuOR3dNCaZpgbp2wheA5anppZ/NU/q+5c
rDxhB3zsvuMuOvPoJJcDXq9Xok0akYBDRgHMqNU4a04ukKwL6DKzk0NRCF/df36h
o7za3nX2UYm4i99arBACEIF9KUNl3dBZIMAS4AamodiSq5dVqIcxF4mcIVN0niFn
u3NE+q1Lliu7BLcpuBucVS/FHeue9QIGUI/UFuZs+8Yzeo6AZ63GM4Sh4RD3q2CB
wtADslVdHfdSPWTVL90jaIJ/5iQEunaXO9uGw5SUyVD55RgZgBNcO58/187Za1Ew
W5sRyFrFpvhOfygG4wHmbzhznO8VQzUSLYouURiIypjrf2lNIAECqHEftRkLtMP5
7AeODQcaUWVTvVDvx/rC
=pB3q
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXBHRCmaOgq3Tt24GAQhMjw//bxQ0nXwpuqAhwT2/a6LTUTZFm+OPvg/T
R1bZmTvYbvnh9AdV0by9NfqmTxLTe1Q+Jiso+B4CgbQIAo3KYOSspEDqt0TFOmyS
QN5B6uhnsG2AEwNZs3o1mtDYqe6nZvS9vjnxg3D1hTJ4mYLu1+DM7oREXoo+Rs9f
aF8h9u6JMvANa95dC8wPAru4FCW/JBrQPSvBosPN5AFR0YY6jxAPdCeJc/FMvQQz
KhZXuRXfeE6du31H7j/xvz8jT4Dxun4h7PYU8C/1LaFFv2kAp1m//zOGb4UmwSZq
2TPYxswAQk3JkYCzum9mqoxHSd0XgTDSQQ8IWv+QvyFzpeOZ86bciakII8jcKLVI
FU6C/tbHIJ/KH+FNQp1LDXCpF1bBhnaoAsDAd0CwdpOIYJmSamAgWIvYc8u1NteE
+LV3tcvIKcCBNkOWk2qamB92InWtcgzwHzqFQnJL/UFtunpbgfj2+Xiau5YbTrH6
9RjYorWFli3Osh1FY1u1AVWUZL9JyzbVN8RHRKdSGkBpwxRzJ87IdhlhpKGsmH4z
CRNKZB25ZUpgLPwN953Rjww+vrxaGPTusuYuYW88pIEov47mumYd6210rmwCR5JC
ePXc/ZduNBvTDNnmshfnT9jzYeuXbUFpfGf+0RyQCBUJYp1YOAs+dNDz4Rif2QdB
bm5Nsr6JFg4=
=2QYQ
-----END PGP SIGNATURE-----