Terminal escape sequence command injection vulnerability in Apache HTTP Server logs

Release date:
Updated on:

Affected Systems:
Apache Group HTTP Server 2.2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 59826
CVE (CAN) ID: CVE-2013-1862
 
Apache HTTP Server is an open source HTTP Server.

When Apache HTTP Server mod_rewrite writes data to a log file, no characters that cannot be printed are filtered. If mod_rewrite uses the command RewriteLog, remote attackers can exploit this vulnerability to write terminal escape sequences to log files. If the HTTP request contains the escape sequence of the terminal simulator, this vulnerability can also cause arbitrary command execution.
 
<* Source: Joe Orton

Link: https://bugzilla.redhat.com/show_bug.cgi? Id = 953729
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Apache Group
------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Http://httpd.apache.org/
Http://people.apache.org /~ Jorton/mod_rewrite-CVE-2013-1862.patch