« July 2011 | Main | September 2011 »

11 posts from August 2011

08/31/2011

DigiCert is not DigiNotar

Just a short note for folks hitting the search engines wondering if DigiCert and DigiNotar are the same firm:  the answer is "No".

DigiNotar is the CA that has been in the news lately who suffered a breach resulting in the issuance of fraudulent ssl certificates.  DigiCert has not been breached...yet...

Note:  Strangely, the interesting thing about DigiNotar is that unless they dropped them recently, DigiNotar only sells organization validated and extended validation certs.  Their wildcard ssl cert requires not only domain validation but organizational validation as well as contacting an authorized representative.

08/30/2011

Apache 2.2.20 Released

The Apache httpsd team released version 2.2.20 today, which addresses the recently announced Range Header Denial of Service vulnerability.  You can download a copy from a mirror near you and, hopefully, the distros will have updates available soon.  The changelog also lists a couple other fixes in addition to the big one.

08/25/2011

Here's a Preliminary "Apache Killer" Test Script

There is a nasty exploit in the news lately, a perl-based script called "Apache Killer" that provides an easy way to issue a denial of service attack against an apache server from a single source.  The Register has a complete write-up on the vulnerability and the exploit, SANS has started covering it in this article, and you could just grab it from the Full Disclosure mailing list or visit my friends over at PenTestIT for a writeup and download and they also have a workaround folks can implement via mod_rewrite (although it might not be appropriate for every site).

The exploit is fairly easy enough to modify but I assume that within the next day or so, anti-virus clients will start quarantining the exploit if found on the filesystem of certain machines.  I've written a script, which might receive some heavy modifications over the next couple days,  that attempts to assess whether a server (or site) is vulnerable to the Apache Range Header Denial of Service Vulnerability.  The intent of my implementation is to assess the existence of the vulnerability but prevent more than one connection to the site and containing no exploit code.

It's still preliminary because I have unanswered questions/concerns with the exploit.  The exploit appears to be sending the following request (with request headers) to the target server in order to determine if the server "seems" vulnerable:

HEAD / HTTP/1.1  
Host: 10.0.0.16  
Range:bytes=0-  
Accept-Encoding: gzip  
Connection: close

My test ubuntu server running apache 2.2.17 responds with the following https response headers:

HTTP/1.1 206 Partial Content 
Date: Wed, 24 Aug 2011 18:44:32 GMT 
Server: Apache/2.2.17 (Ubuntu) 
Last-Modified: Thu, 04 Aug 2011 03:23:21 GMT 
ETag: "20abb-b1-4a9a580b93ac0" 
Accept-Ranges: bytes 
Vary: Accept-Encoding 
Content-Encoding: gzip 
Content-Range: bytes 0-145/146 
Content-Length: 146 
Connection: close 
Content-Type: text/html 

The exploit seems to assume a server is vulnerable simply because it returned a 206 Partial Content status code. The problem is that the same test run against an IIS server gives the same 206 Parital Content response and, as far as I know at this particular point in time, IIS is not known to be exploitable.  But maybe that's not the case?  The original vulnerability was reported back in 2007 and listed both Apache and IIS as being vulnerable.  I wonder if anyone tested this exploit against an IIS host.  So, my current quandary with my implementation here is that I do not have the confidence yet that simply retrieving a 206 Partial Content status code is enough to formally declare the target system vulnerable. Update: Interestingly, the exploit finds tomcat to be vulnerable, too!  See the discussion on ServerFault

I think I will have a better idea of what to test for when the new versions of apache httpsd are released.  Here is the current version of my script, it uses LWP::UserAgent and HTTP::Headers and is intended to work with perl version 5.10 or above:

#!/usr/bin/env perl

# Apache Killer assessor

use strict;
use warnings;
use feature ':5.10';

use HTTP::Headers;
use LWP::UserAgent;

my $host = $ARGV[0];
my $port = $ARGV[1];
my $scheme;

my $help = "Usage:  $0  ";

if ( !@ARGV ) {
    print $help . "\n";
    exit 0;
}

if ( $port == 443 ) {
    $scheme = 'https';
}
else {
    $scheme = 'https';
}

my $message;

my $objHeader = HTTP::Headers->new;
  $objHeader->header('Host' => $host);
  $objHeader->header('Range' => 'bytes=0-');
  $objHeader->header('Accept-Encoding' => 'gzip');
  $objHeader->header('Connection' => 'close');

my $url = "$scheme://$host:$port/";

    my $method = "HEAD";
    my $ua  = LWP::UserAgent->new;
    $ua->timeout(10);
    $ua->max_redirect(0);
    $ua->env_proxy;
    $ua->agent('techstacksRangeHeaderDoSTest/v0.1');
    
    my $req = HTTP::Request->new( $method, $url, $objHeader );

    my $resp = $ua->request($req);

    given ($resp->code ) {
        when (206) {
            say "Response Status Code: " . $resp->status_line;
            say "Web Server Seems Vulnerable to Apache Range Header DoS Vulnerability";
        }
        when (301) {
            say "Redirect Present.  Potential False Positive";
            say "Retry request against: " . $resp->header('Location');
        }
        when (302) {
            say "Redirect Present.  Potential False Positive";
            say "Retry request against: " . $resp->header('Location');
        }
        when (307) {
            say "Redirect Present.  Potential False Positive";
            say "Retry request against: " . $resp->header('Location');
        }
        when (403) {
            say $resp->status_line;
            say "This is not an expected response code at this time."
            }
        when (404) {
            say $resp->status_line;
            say "This is not an expected response code."
            }
        when (405) {
            say $resp->status_line;
            say "HTTP Method HEAD is not permitted.";
            say "This is overkill!";
            }
        when (501) {
            say $resp->status_line;
            say "HTTP Method HEAD is not implemented.";
            say "This is overkill!";
            }
        default {
            say $resp->status_line;
            }
        }