Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Daniel Ruggeri &lt;druggeri () apache org&gt;

Date: Sat, 8 Aug 2020 07:02:21 -0500

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Hi, Alexander;

On 8/7/2020 7:54 AM, Solar Designer wrote:
Hi Daniel,

On Fri, Aug 07, 2020 at 06:31:38AM -0500, Daniel Ruggeri wrote:
CVE-2020-11984: mod_uwsgi buffer overlow

Severity: moderate

Vendor: The Apache Software Foundation

Versions Affected:
httpd 2.4.32 to 2.4.44

Description:
Apache HTTP Server 2.4.32 to 2.4.44
mod_proxy_uwsgi info disclosure and possible RCE
    
Mitigation:
disable mod_uwsgi
You appear to use mod_uwsgi and mod_proxy_uwsgi interchangeably in the
above, but I guess they're actually different modules?
Yes, you're correct. There is a mod_uwsgi maintained elsewhere in the
wild. This one was a typo that had made its way into the description.

Credit:
Discovered by Felix Wilhelm of Google Project Zero

References:
https://httpd.apache.org/security/vulnerabilities_24.html
The vulnerability description at that link mentions mod_proxy_uwsgi
only, so I guess it's the one affected module, whereas mod_uwsgi is
unaffected?

In general, I think you include too little detail in these postings and
at the link above.  You do include the bare minimum (thanks!), but it is
unclear from these announcements where in the code the issues are.  You
could reference source files and function names and/or commits fixing
the issues.  You could also describe the impact in more detail - e.g.,
what kind of "info disclosure" (what info is potentially disclosed and
to where).  I am just using this as an example of how I think you could
improve reporting on Apache httpd vulnerabilities in general.

Thanks - I've included our security mailing list to pass this feedback
along to the rest of the security group as a heads up. As you can
imagine, with such a strong downstream community from our releases, we
try to be careful so as to not place too much information in the
descriptions to make it trivial to exploit vulnerabilities before those
downstream packagers can incorporate fixes. At the same time, there's
always room for improvement :-)

Have a great weekend!

Thanks,

Alexander

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Daniel Ruggeri (Aug 07)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Solar Designer (Aug 07)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Daniel Ruggeri (Aug 08)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Solar Designer (Aug 08)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Joe Orton (Aug 17)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Seth Arnold (Aug 07)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Daniel Ruggeri (Aug 08)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Seth Arnold (Aug 10)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->