Rule: -- Sid: 1808 -- Summary: An attacker is using exploit code for the Apache chunked encoding vulnerability against your web server. -- Impact: If successful, this exploit can allow attackers to cause code of their choice to run on your server or cause a denial of service. -- Detailed Information: Older versions of the Apache HTTP server suffered from a bug in the routines that handled chunked encoding. This exploit takes advantage of this vulnerability. -- Affected Systems: Version of Apache 1.3 up to and including 1.3.24 and versions of Apache 2.0 up to 2.0.36. All versions of Apache 1.2 are vulnerable. Although this vulnerability is present in all ports of Apache, the exploit code detected by this signature appears to only work against systems running BSD. -- Attack Scenarios: An attacker can take advantage of a widely available exploit script to compromise the server. -- Ease of Attack: Simple. Exploit scripts are available. -- False Positives: None known. -- False Negatives: This signature detects specific exploit code that targets systems running BSD. It is certainly possible for this vulnerability to be exploited in ways other than those detected by this signature. -- Corrective Action: Ensure that you are running a version of Apache newer than those listed in the "affected systems" section. -- Contributors: Sourcefire Research Team Brian Caswell <bmc@sourcefire.com> Snort documentation contributed by Kevin Peuhkurinen -- Additional References: Apache http server project http://httpd.apache.org/info/security_bulletin_20020620.txt --
