Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against A Format String Vulnerability in mod_auth_pgsql for Apache

Subscribe

Check Point Reference: CPAI-2006-014
Date Published:
Severity:
Last Updated:
Source: iDEFENSE ADVISORY: 01.09.06
Industry Reference(s): CVE-2005-3656
Protection Provided by: VPN-1
  • NGX R60
  • NG with Application Intelligence R55W
  • NG with Application Intelligence R55
  • NG with Application Intelligence R54
InterSpect
  • NGX
  • 2.0 and 1.x
Who is Vulnerable?
version 2.0.2b1 of mod_auth_pgsql for Apache 2.x
Vulnerability Description
A vulnerability exists in multiple versions of an authentication module (mod_auth_pgsql) for Apache httpd. To exploit this vulnerability, a user can supply specially crafted information to trigger a flaw in certain logging functions of the module. Successful exploitation could result in the execution of arbitrary code on the target system.

This module is not installed by default, but is available as a package from some vendors, including Red Hat Linux, Debian GNU/Linux and FreeBSD. Only systems that have the mod_auth_pgsql module installed and are configured to authenticate against a PostgreSQL database using this module are affected.
Vulnerability Details
The mod_auth_pgsql module for the Apache httpd is a third party authentication module which allows authentication details to be stored in a PostgreSQL database. To exploit the vulnerability, the attacker must know the URI of at least one resource on the Web server which authenticates using this module.

Protection Overview
The update blocks the vulnerability based on a unique HTTP header pattern.

To configure the defense, select your product from the list below and follow the related protection steps.

Additional Information
The update also includes the following protections:

  • Microsoft Windows Embedded Opentype Fonts (EOT) (CPAI-2006-010)
  • PHP ADOdb Test Scripts and PHP shell/web defacement tool (CPAI-2006-011)
  • HP OpenView Remote Command Execution (CPAI-2006-012)
  • Oracle XDB HTTP Buffer Overflow (CPAI-2006-013)
  • Apache Format string Vulnerability (CPAI-2006-014)

VPN-1 NGX R60

How Can I Protect My Network?
Users of VPN-1 NGX R60 should update their SmartDefense by clicking Online Update in the SmartDashboard General window.

To enable the protection:
1. In the left pane, select Profiles > Default Protection and select the Web Intelligence page of the profile.  
2. In the Web Intelligence tree, click HTTP Protocol Inspection > Header Rejection and enable the following patterns:
Apache Format String1
Apache Format String2
3. Install policy on all modules. 

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Header Rejection
Attack Information:
Apache Format String1
Apache Format String2

InterSpect NGX

How Can I Protect My Network?
Users of InterSpect NGX should update their systems: In the left pane from the drop-down list, select Profiles > SmartDefense Service and click the Online Update button.

To enable the protection:

1. In the left pane, select Profiles > Default Protection and select the Web Intelligence page of the profile.  
2. In the Web Intelligence tree, click HTTP Protocol Inspection > Header Rejection and enable the following patterns:
Apache Format String1
Apache Format String2
3. Install policy on all modules. 

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Header Rejection
Attack Information:
Apache Format String1
Apache Format String2

VPN-1 NG with Application Intelligence R55W

How Can I Protect My Network?

Users of VPN-1 NG with Application Intelligence R55W should update their SmartDefense by clicking Online Update in the SmartDashboard General window.

To enable the protection:

1. On the Web Intelligence tree, click HTTP Protocol Inspection > Header Rejection and enable the following patterns:
Apache Format String1
Apache Format String2
2. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Header Rejection
Attack Information:
Apache Format String1
Apache Format String2

VPN-1 NG with Application Intelligence R55/R54

How Can I Protect My Network?
Users of VPN-1 NG with Application Intelligence R55/R54 should update their SmartDefense by clicking Update Now in the SmartDashboard General window.

To enable the protection:
1. On the SmartDefense tree, click Application Intelligence > Web > Peer to Peer and in the Headers Detection table, enable the following patterns:
Apache Format String1
Apache Format String2
2. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Header Rejection
Attack Information:
Apache Format String1
Apache Format String2

InterSpect 2.0, 1.x

How Can I Protect My Network?

Users of InterSpect 2.0/1.x should update their SmartDefense by clicking Online Update in the SmartDashboard General window.

To enable the protection:
1. On the SmartDefense tree, click Application Intelligence > Web > Peer to Peer and enable the following patterns:
Apache Format String1
Apache Format String2
2. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Header Rejection
Attack Information:
Apache Format String1
Apache Format String2