17.4. CVE-2012-5641: Information disclosure via unescaped backslashes in URLs on Windows

17.4.1. Description

A specially crafted request could be used to access content directly thatwould otherwise be protected by inbuilt CouchDB security mechanisms. Thisrequest could retrieve in binary form any CouchDB database, including theusers_ or replication_ databases, or any other file that the user accountused to run CouchDB might have read access to on the local filesystem. Thisexploit is due to a vulnerability in the included MochiWeb HTTP library.

17.4.2. Mitigation

Upgrade to a supported CouchDB release that includes this fix, such as:

• 1.0.4
• 1.1.2
• 1.2.1
• 1.3.x
  All listed releases have included a specific fix for the MochiWeb component.

17.4.3. Work-Around

Users may simply exclude any file-based web serving components directlywithin their configuration file, typically in local.ini. On a defaultCouchDB installation, this requires amending thehttpd_global_handlers/favicon.ico and httpd_global_handlers/_utils_lines within _httpd_global_handlers:

[httpd_global_handlers]
favicon.ico = {couch_httpd_misc_handlers, handle_welcome_req, <<"Forbidden">>}
_utils = {couch_httpd_misc_handlers, handle_welcome_req, <<"Forbidden">>}

If additional handlers have been added, such as to support Adobe’s Flashcrossdomain.xml files, these would also need to be excluded.

17.4.4. Acknowledgement

The issue was found and reported by Sriram Melkote to the upstream MochiWebproject.

17.4.5. References

• https://github.com/melkote/mochiweb/commit/ac2bf

原文: http://docs.couchdb.org/en/stable/cve/2012-5641.html