title: Apache httpd vulnerability on macOS BigSur
body: <p>I'm on the latest macOS (BigSur 11.4 20F71) and discovered a critical vulnerability in Apache httpd, which is located here <code>/usr/sbin/httpd</code>. I never installed Apache httpd on my mac. <code>/usr/sbin</code> is a <strong>Read-Only file system</strong> (Protected by SIP &quot;System Integrity Protection&quot;) and it isn't possible to install anything in that folder, even as a root user, which makes me think that Apache http is bundled with BigSur by default. If so, how can I install the latest patch?</p>
  <p>The vulnerable version is 2.4.46 and there's a fix in 2.4.47, but I've had real issues updating httpd.</p>
  <pre><code>&gt; /usr/sbin/httpd -v
  Server version: Apache/2.4.46 (Unix)
  Server built:   May  8 2021 03:38:34
  </code></pre>
  <h3>Things I've tried so far:</h3>
  <ul>
  <li>Install the latest version of httpd using homebrew. It installs the correct version in <code>/usr/local/bin</code> which isn't OK because it still leaves the vulnerable version intact.</li>
  <li>Making any change to <code>/usr/sbin/httpd</code> throws a &quot;Operation not permitted&quot; error, which led me to try to
  <a href="https://stackoverflow.com/questions/32659348/operation-not-permitted-when-on-root-el-capitan-rootless-disabled">Disable System Integrity Protection</a> because it should make the file system writable. After disabling it I tried to manually install the latest version of the httpd binary into /usr/sbin/httpd, but I still get this error: <code>/usr/sbin/httpd: Read-only file system</code>. It looks like it's not possible to disable SIP completely.</li>
  </ul>
  <p>How can I resolve this? This vulnerability was discovered on June 6th, so it's over the 14 day limit required by a lot of InfoSec regulators to implement a fix.</p>
  <h3>For reference, here are the details of the vulnerability (From Nessus):</h3>
  <p>The version of Apache httpd installed on the remote host is prior to 2.4.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.47 changelog:</p>
  <ul>
  <li><p>Unexpected  section matching with 'MergeSlashes OFF' (CVE-2021-30641)</p>
  </li>
  <li><p>mod_auth_digest: possible stack overflow by one nul byte while validating the Digest nonce. (CVE-2020-35452)</p>
  </li>
  <li><p>mod_session: Fix possible crash due to NULL pointer dereference, which could be used to cause a Denial of Service with a malicious backend server and SessionHeader. (CVE-2021-26691)</p>
  </li>
  <li><p>mod_session: Fix possible crash due to NULL pointer dereference, which could be used to cause a Denial of Service.
  (CVE-2021-26690)</p>
  </li>
  <li><p>mod_proxy_http: Fix possible crash due to NULL pointer dereference, which could be used to cause a Denial of Service. (CVE-2020-13950)</p>
  </li>
  <li><p>Windows: Prevent local users from stopping the httpd process (CVE-2020-13938)</p>
  </li>
  <li><p>mod_proxy_wstunnel, mod_proxy_http: Handle Upgradable protocols end-to-end negotiation. (CVE-2019-17567)</p>
  </li>
  </ul>