Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Apache mod_proxy_ftp XSS Vulnerability

Subscribe

Check Point Reference: CPAI-2008-222
Date Published:
Severity:
Source: Secunia Advisory: SA31384

 

Industry Reference(s): CVE-2008-2939
US-CERT VU#663763
Protection Provided by: IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Apache 2.0.x
Apache 2.2.x
Vulnerability Description
The Apache web server mod_proxy_ftp module is prone to a a cross-site scripting (XSS) vulnerability. The Apache mod_proxy_ftp module allows the Apache web server to act as a proxy for FTP sites. By sending a crafted URL to the module, an attacker can execute arbitrary HTML and script code in a user's browser session in the context of an affected site.
Update/Patch Available
Apache has released updates to address this issue:
http://svn.apache.org/viewvc?view=rev&revision=682868
http://svn.apache.org/viewvc?view=rev&revision=682870
http://svn.apache.org/viewvc?view=rev&revision=682871
Vulnerability Details
The mod_proxy_ftp module contains a vulnerability that occurs because the module does not properly sanitize input passed to the module via a URL containing a FTP wildcard character (e.g. "*"). This can be exploited to conduct cross site scripting attacks.

Protection Overview
This protection will block FTP file listings containing javascript tags.

To configure the defense, select your product from the list below and follow the related protection steps.

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > WWW2, and select the User-Definable Variables group
3. Click Filename Requested contains a user-defined bad filename (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?

Upon an attack, the following entries will be logged:

Alert Name: www2_uservars
 Description: filenamecontain_alert