CVE-2017-9798: Use After Free (CWE-416)
value: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.5
Published: 2017-09-18T15:29Z
Repository: https://github.com/apache/httpd
Language: Other
Files changed: CHANGES, server/core.c
Commit date: 2017-09-07 22:43:41 +0000
Commit message: core: Disallow Methods' registration at run time (.htaccess), they may be
used only if registered at init time (httpd.conf).

Calling ap_method_register() in children processes is not the right scope
since it won't be shared for all requests.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1807655 13f79535-47bb-0310-9956-ffa450edef68

Diff: diff --git a/CHANGES b/CHANGES
index 4ca0e4cc822..2b744675e78 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,8 +1,11 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) core: Disallow Methods' registration at runtime (.htaccess), they may be
+     used only if registered at init time (httpd.conf).  [Yann Ylavic]
+
   *) mod_md: v0.9.1:
      - various fixes in MDRenewWindow handling when specifying percent. Serialization changed. If 
        someone already used percent configurations, it is advised to change these to a new value,
        reload and change back to the wanted ones.
      - various fixes in handling of MDPrivateKeys when specifying 2048 bits (the default) explicitly.
diff --git a/server/core.c b/server/core.c
index 76adb4d8693..c9b6837bd41 100644
--- a/server/core.c
+++ b/server/core.c
@@ -2329,10 +2329,16 @@ AP_CORE_DECLARE_NONSTD(const char *) ap_limit_section(cmd_parms *cmd,
         }
         else if (methnum == M_INVALID) {
             /* method has not been registered yet, but resource restriction
              * is always checked before method handling, so register it.
              */
+            if (cmd->pool == cmd->temp_pool) {
+                /* In .htaccess, we can't globally register new methods. */
+                return apr_psprintf(cmd->pool, "Could not register method '%s' "
+                                   "for %s from .htaccess configuration",
+                                    method, cmd->cmd->name);
+            }
             methnum = ap_method_register(cmd->pool,
                                          apr_pstrdup(cmd->pool, method));
         }
 
         limited |= (AP_METHOD_BIT << methnum);

Fixed code:   *) core: Disallow Methods' registration at runtime (.htaccess), they may be
     used only if registered at init time (httpd.conf).  [Yann Ylavic]

            if (cmd->pool == cmd->temp_pool) {
                /* In .htaccess, we can't globally register new methods. */
                return apr_psprintf(cmd->pool, "Could not register method '%s' "
                                   "for %s from .htaccess configuration",
                                    method, cmd->cmd->name);
            }