IT Security Research
IT Security Advisory
The innovations for the future need
secure foundations today.
With information technology now embedded in all business activities, security is an enterprise concern.

Apache 2.2.14 mod_isapi Dangling Pointer

Sense of Security - Security Advisory - SOS-10-002 security advisory

Release Date.                  5-Mar-2010
Last Update.                   -
Vendor Notification Date.      9-Feb-2010
Product.                       Apache HTTP Server
Platform.                      Microsoft Windows
Affected versions.             2.2.14 verified and 
                               possibly others.
Severity Rating.               High
Impact.                        System access
Attack Vector.                 Remote
Solution Status.               Upgrade to 2.2.15 (as advised by
CVE reference.                 CVE-2010-0425

The Apache HTTP Server, commonly referred to as Apache, is a 
popular open source web server software. mod_isapi is a core 
module of the Apache package that implements the Internet Server 
extension API. The extension allows Apache to serve Internet 
Server extensions (ISAPI .dll modules) for Microsoft Windows 
based hosts.

By sending a specially crafted request followed by a reset packet 
it is possible to trigger a vulnerability in Apache mod_isapi 
that will unload the target ISAPI module from memory. However 
function pointers still remain in memory and are called when 
published ISAPI functions are referenced. This results in a 
dangling pointer vulnerability. 

Successful exploitation results in the execution of arbitrary 
code with SYSTEM privileges.

Proof of Concept.
Proof of concept code is available for this vulnerability. The 
payload will write a text file (sos.txt) to the Apache working 
directory demonstrating that code execution is possible. The 
code can be downloaded from the following link:

Furthermore, a video demonstrating the exploitation of this 
vulnerability using a bind shell has been created.

Upgrade to the latest version of Apache HTTP Server (currently 

Discovered by.
Brett Gervasoni from Sense of Security Labs. Brett is a member of 
Sense of Security's award winning penetration test team.
Reset Font Size Increase Font Size Contact us via email form Share/Save/Bookmark

Telephone 1300 922 923.

For an engagement enquiry.
For an information request.