Overview Of Common Vulnerabilities And Exposures Computer Science Essay

Vulnerability is a programming error that can be used to harm or misapply a computing machine system. The term injury may intend leting entree and/or informations alteration without proper security hallmark. However it non limited merely to unsecure entree. The term can besides mention to any debatable status in computing machine system that can do one or more of the followers:

A user can portray as any other user

A user can go against informations limitations as imposed by security entree

A user can put to death bids as some other user or put to death bids that are non authorized.

A user can convey down the services offered and create denial of service.

Some issues can be caused by constellation errors. These types of mistakes are non programming errors as in instance of exposure. These are called exposures. Exposure is non vulnerability but a error that can be exploited in one or more of the undermentioned ways:

A user can entree information that is beyond the entree degree defined for him.

A user can come in the system without hallmark or utilizing improper hallmark.

A user can transgress the security at any degree of the system.

A user can compromise the security wholly by reconfiguring the security apparatus.

A list of such exposures and exposures is maintained by MITRE Corporation. MITRE Corporation takes aid from CVE editorial board it constitutes. CVE-2010-3872 is portion of this list.

Any user or developer can subject an issue as a exposure or exposure. CVE column board so reviews the entry and updates the published list online. As given by CVE database CVE 2010-3872 is still in under reappraisal position. It means that this peculiar CVE is yet to be accepted by the CVE Editorial Board as exposure. CWE, Common failing Enumeration, ID for CVE-2010-3872 is CWE-189. CWE-189 stands for numeral mistake that can be caused by whole number flood, stack flood, or any other mistake that can be caused when managing Numberss.

What is CVE-2010-3872?

CVE-2010-3872 is programming mistake identified by Edgar Frank in Apache ‘s fast CGI application execution. Fast CGI is faster version of CGI, common gate manner interface. CGI provides a standard manner of bring forthing dynamic contents in a web based system. Dynamic content means the end product displayed by web based system is decided at the tally clip conditionally based on the inputs provided by the user. For illustration a web page will expose user penchants based on the user Idaho of the logged in user. Generating dynamic contents meant that a plan needs to be executed after the user inputs his penchants and this plan will take user inputs, user Idaho in the above instance, and bring forth informations that matches the input, in this instance user penchants. The consequences of the plan are so passed back to the browser. Apache has written HTTP waiter package. This HTTP waiter accepts browser petitions over the cyberspace and returns the consequences back to the users. However it can merely return the inactive content. In order to let books bring forthing dynamic informations to be executed safely at the HTTP server a CGI application was written. CGI allowed HTTP waiter to put to death books that generated informations at the runtime based on the user input. Every clip user requested data the book would be called, executed and consequences would be returned to the browser. However it was shortly realized that this had important public presentation constriction. User petitions came in often and each clip the book was loaded into the memory and executed. Apache so implemented a better version of CGI called fast CGI. This fast CGI application loaded a peculiar figure of transcripts of the book into the memory and every clip user requested for the informations the book that was already present in the memory was used to acquire the needed information. This was significantly faster than lading the book each clip. After functioning the petition for a peculiar user, a book so remains loaded in the memory in order to accept petitions from other users. This undertaking was called mod_fcgi undertaking by Apache. However while implementing fast CGI there was a scheduling mistake, mod_fcgid release versions prior to 2.3.6, in fcgid_bucket.c, portion of mod_fcgid codification base, that could take to potentially harmful consequences. This coding mistake can be exploited locally or remotely by put to deathing untrusted CGI books. This defect is identified as CVE-2010-3872. The description of this CVE as found in the CVE database is:

“ The apr_status_t fcgid_header_bucket_read map in fcgid_bucket.c in Apache mod_fcgid before 2.3.6 does non utilize bytewise arrow arithmetic in certain fortunes, which has unknown impact and onslaught vectors related to “ untrusted FastCGI applications ” and a “ stack buffer overwrite. ”

What is the position and badness of CVE-2010-3872?

CVE reappraisal board has kept this exposure under reappraisal as on 27 March, 2011. The badness of CVE-2010-3872 is P2.

What is CVSS mark for CVE-2010-3872?

CVSS, common exposure hiting system, is an unfastened model for standardising the nature and impact of a exposure. CVSS mark is identified based on three groups viz. base, temporal and environmental. Each badness is evaluated in these groups to bring forth a numeral value in the scope 0-10 and a vector that is textual representation of the mark obtained. Base group gives the concealed qualities of the exposure, temporal group defines the qualities of the exposure that may alter over clip, and environmental qualities try to specify specific environmental properties that affect the exposure.

The CVSS mark for CVE-2010-3872 exposure is 7.2. To find a base mark for any exposure following parametric quantities are used:

Exploitability Matrixs:

Related exploit scope ( Access Vector ) : Access vector defines how a complexness can be exploited. Three possible values for this vector are Local, Adjacent web and Network. Local means the exposure can merely be exploited locally by utilizing a shell history on the machine or by holding physical entree to the machine. Adjacent web means aggressor needs entree to air or hit sphere. Any exposure that can be remotely exploited falls under class Network. For CVE-2010-3872 Access Vector value is ‘Local ‘ .

Attack Complexity ( Access Complexity ) : Access complexness attempts to place the complexness involved in working the exposure. It has three possible values high, medium, and low. High value means aggressor demands specialised entree conditions. Medium entree complexness means entree conditions are specialized but non rare. And low entree complexness means no specialised entree conditions are required. For CVE-2010-3872 Attack Complexity is ‘Low ‘ . Some illustration of Low entree complexness can be given as:

System allows anon. or untrusted entree utilizing which aggressor can entree the system without any privileges.

System constellations are common and really easy to be understood and attacked.

really small cognition or accomplishment is required to work the exposure

really common and winnable race status.

Degree of Authentication ( Authentication ) : This vector identifies the figure of times the user must authenticate before he can work the exposure. The three possible values for the vector are multiple, individual and none. Multiple indicates that the aggressor needs to authenticate twice or more figure times in order to derive entree. Once indicates aggressor demands to authenticate merely one time. And as for CVE-2010-3872, hallmark degree ‘None ‘ means no hallmark is required to work this exposure.

Impact Matrixs

Confidentiality Impact ( ConfImpact ) : This vector identifies the impact on confidentiality. Confidentiality means restricting information entree and revelation to merely authorise user. The three possible values for the vector are None, Partial and Complete. None suggests that there is no impact on confidentiality. The partial impact means aggressor obtains significant information nevertheless he does non hold control over the information that is obtained. Complete impact agencies there is entire information revelation. Attacker is able all the system information. For CVE-2010-3872 this is ‘Complete ‘ .

Integrity impact ( IntegImpact ) : This vector identifies the consequence on the information of the system i.e. whether the trustiness of the information has been compromised or non. Three possible values for this vector are none, partial and complete. None indicates that there is no impact on the unity of the system. Partial indicates that alteration of system files or information is possible nevertheless the aggressor does non hold the control over what he can modify. And complete indicates that there is entire loss of unity. Attacker can modify any files on the system. For CVE-2010-3872 value of this vector is ‘Complete ‘ .

Availability Impact ( AvailImpact ) : Handiness refers to handiness of the information i.e. whether the information is accessible in a manner similar to the manner before the onslaught. Three possible values for this vector are none, partial and complete. None means there is no impact on handiness. Partial agencies there is decreased public presentation of the system or the system is available with breaks. And complete agencies there is entire closure of the resources and the peculiar system is wholly unavailable. For CVE-2010-3872 this is ‘Complete ‘ .

As mentioned earlier this exposure is due to an mistake in the scheduling and particularly in boundary status. As this boundary status exists in all the available constellations and platform the menace degree of this exposure is independent of platform.

Technical inside informations

First it is of import to setup up Apache waiter to work with fast CGI. To make that, let CGI executing on Apache web waiter. Let this by specifying options directing inside the chief waiter constellation file:

& lt ; Directory /usr/local/apache2/htdocs/somedir & gt ;

Options +ExecCGI

& lt ; /Directory & gt ;

Specifying ExecCGI option will all executing of cgi files present in the default cgi directory of the Apache web waiter. However server will still non able to place what CGI file agencies. To let waiter to place a file s as a cgi file usage addHandler directive which tells the waiter what constellation files mean, i.e. what is the extension for the cgi file. Here is an illustration of the addHandler directive:

AddHandler cgi-script.cgi.pl

For a plan to be accessed utilizing FastCGI protocol, the plan needs to be assigned fcgid-script animal trainer. Once a plan is assigned to FastCGI protocol, fastCGI server creates fixed figure of cases of this plan into the memory. These cases continue to function one petition after another. These cases portion the resources available on the waiter amongst themselves. As these resources are limited it is of import that the system decision maker configures figure of initial cases created optimally to function figure of coincident petitions and entire available resources. A sample fast cgi application may look like this, complete inside informations are available at Apache Module mod_fcgid:


Perl FastCGI application – /usr/local/apache/fcgi-bin/foo.pl

# ! /usr/bin/perl

usage CGI: :Fast ;

while ( my $ q = CGI: :Fast- & gt ; new ) {

print ( “ Content-Type: text/plain

” ) ;

foreach $ volt-ampere ( kind ( identify ( % ENV ) ) ) {

$ val = $ ENV { $ volt-ampere } ;

$ val =~ s|
|g ;

$ val =~ s| ” | ” |g ;

print “ $ { volt-ampere } = ” $ { val } ”
” ;




The constellation directive to assist put to death this plan:


& lt ; Directory /usr/local/apache/fcgi-bin/ & gt ;

SetHandler fcgid-script

Options +ExecCGI

# Custom-make the following two directives for your demands.

Order allow, deny

Allow from all

& lt ; /Directory & gt ;


Edgar Frank point out that the debatable codification is present at /httpd/mod_fcgid/trunk/modules/fcgid/fcgid_bucket.c. He could place this issue while proving the boundary conditions of the heading value in the undermentioned codification. Edgar pointed out the exact location of the job of the beginning when he filed the bug 49406 in ASF Bugzilla, this is bug describing system for Apache Servers, nexus for this provided in the mentions subdivision. The hole to the job, as mentioned by Edgar in his bug study, requires minor codification alteration which was punctually addressed by Apache in its release 2.3.6. The debatable codification and the hole are described below.

Here is the portion of fcgid_bucket.c codification:


inactive apr_status_t fcgid_header_bucket_read ( apr_bucket * B,

const char **str,

apr_size_t * len,

apr_read_type_e block )


fcgid_bucket_ctx *ctx = ( fcgid_bucket_ctx * ) b- & gt ; informations ;

apr_status_t recreational vehicle ;

apr_size_t hasread, bodysize ;

FCGI_Header heading ;

apr_bucket *curbucket = B ;

/* Initialize heading */

putsize = fcgid_min ( bufferlen, sizeof ( heading ) – hasread ) ;

memcpy ( & A ; heading + hasread, buffer, putsize ) ;

memcpy ( ( char* ) ( & A ; heading ) + hasread, buffer, putsize ) ;

hasread += putsize ;

return apr_bucket_read ( B, str, len, APR_BLOCK_READ ) ;



Note: Use mentions to acquire the base location of the codification. From basal location of Apache-SVN beginning navigate to /httpd/mod_fcgid/trunk/modules/fcgid/ bundle to see fcgid_bucket.c beginning file. Check mentions for Apache-SVN location.

Variable hasread in map fcgid_header_bucket_read is present to forestall copying the bytes in the heading that have already been read. This variable is incremented after every memcpy operation. memcpy operation ( ruddy line ) uses pointer add-on falsely. hasread is of type apr_size_t hence arrow to the variable heading should be typecasted to coal to acquire the coveted location. The manner codification was written causes jobs with the size of buffer for heading when variable hasread is non zero. As buffer size is determined by the putsize which is equal to the size of the heading, the wrong arrow arithmetic will ensue in memory use beyond the allocated memory and as a consequence pile will be trashed and section mistake will happen ; this may even ensue in waiter clang.

How to work this exposure?

Practically there is no exploit available as this is a boundary status and can non be exploited every individual clip under the same fortunes. Understanding of the job mentioned in the CVE does steer towards a likely manner in which this exposure can be exploited. An discernible consequence will be obtained merely when the value of variable hasread, refer to the codification snipping above, is big plenty to do stackoverflow or bufferoverflow exclusion. Stackover flow occurs when plan attempts to utilize ( either read or compose ) more memory than ab initio allotted for the stack, a back-to-back set of memory locations.

Generic stairss that can be followed to reproduce the issue are as follows:

Configure Apache to work with FastCGI application.

Execute external user book utilizing above constellation. External user book should bring forth some informations that user wants to go through back to the browser.

Script should return dynamic content with proper heading information.


Here is the list of merchandises affected by this exposure.

Red Hat Fedora 14

Red Hat Fedora 13

Red Hat Fedora 12

Debian Linux 5.0 sparc

Debian Linux 5.0 s/390

Debian Linux 5.0 powerpc

Debian Linux 5.0 mipsel

Debian Linux 5.0 MIPSs

Debian Linux 5.0 m68k

Debian Linux 5.0 ia-64

Debian Linux 5.0 ia-32

Debian Linux 5.0 hppa

Debian Linux 5.0 armel

Debian Linux 5.0 arm

Debian Linux 5.0 amd64

Debian Linux 5.0 alpha

Debian Linux 5.0

Apache Software Foundation mod_fcgid 2.3.5A

Apache Software Foundation mod_fcgid 2.3.4A

Apache Software Foundation mod_fcgid 2.3.3

The hole was address in 2.3.6 release of Apache. Upgrading package to this release should work out the job. For other platforms please mention to the certification of each platform to acquire the release version and upgrade instructions.


This exercising of identifying and understanding tends to assist one understand the importance of the CVE database. End users of the system will ne’er be able to understand the ground behind an onslaught carried out working such exposure. On the other manus cognition of such exposure non merely helps in understanding the ground behind a possible onslaught but prevent the onslaught wholly. As in the instance of CVE-2010-3872 merely upgrading to the latest version of the package will decide the issue.