David Litchfield - david(a)ngssoftware.com on Bugtraq
Like ISS obviously did, one of the first things NGSSoftware did after the eEye ASP Chunk Transfer Encoding vulnerability came out, was check 'what else' is vulnerable to this kind of issue. Like ISS, NGSSoftware also noted that the Win32 distribution of Apache was vulnerable.
However, our approach to addressing this problem was/is completely different. We alerted Oracle, Apahce and CERT.
Our last response from Mark Fox of Apache was that they "have decided that we need to co-ordinate this issue with CERT so that we can get other vendors who ship Apache in their OS and projects aheads-up to this issue." NGSSoftware, of course agreed that this would be the best plan of action as most people who use the Win32 Apache version do not have a compiler and so can take steps to protect themselves. They're mostly relying on their apache 'supplier' to produce a patch.
Of course, with a premature release from ISS many are now left vulnerable without a patch from the apache 'supplier'.
This, now, leads to the next issue. There have been many instances where two or more security organizations discover the same vulnerability at the same time but differ in the manner and time at which they choose to alert the general public, leading to all sorts of problems.
When a vendor is alerted the VCC is CC'd (pun not intentional) and this way a co-ordinated full alert can go out when the time is right.
Marc Maiffret - marc(a)eeye.com on BugTraq
You bring up a good point David. Barely anyone in the Windows world is going to sit and recompile their Apache versions especially with software like Oracle that also uses Apache. ISS has left all these people in a _very_ bad position.
It is worse than that though. According to Apache the ISS source code patch does not even work.
Since there has actually been many chunked encoding vulnerabilities released lately, and exploits (for win32) it only makes sense that it will take no time for someone to develop an exploit for this Apache Win32 chunked overflow, and then start using that to break into systems and what not.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.