Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2007.0885 -- [RedHat]
Moderate: httpd security, bug fix, and enhancement update
8 November 2007
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: httpd
Publisher: Red Hat
Operating System: Red Hat Linux 5
Impact: Denial of Service
Access: Remote/Unauthenticated
CVE Names: CVE-2007-3847
Ref: ESB-2007.0843
Original Bulletin: https://rhn.redhat.com/errata/RHSA-2007-0746.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: httpd security, bug fix, and enhancement update
Advisory ID: RHSA-2007:0746-04
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0746.html
Issue date: 2007-11-07
Updated on: 2007-11-07
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-3847
- - ---------------------------------------------------------------------
1. Summary:
Updated httpd packages that fix a security issue, fix various bugs, and
add enhancements, are now available for Red Hat Enterprise Linux 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
3. Problem description:
The Apache HTTP Server is a popular and freely-available Web server.
A flaw was found in the Apache HTTP Server mod_proxy module. On sites where
a reverse proxy is configured, a remote attacker could send a carefully
crafted request that would cause the Apache child process handling that
request to crash. On sites where a forward proxy is configured, an attacker
could cause a similar crash if a user could be persuaded to visit a
malicious site using the proxy. This could lead to a denial of service if
using a threaded Multi-Processing Module. (CVE-2007-3847)
As well, these updated packages fix the following bugs:
* Set-Cookie headers with a status code of 3xx are not forwarded to
clients when the "ProxyErrorOverride" directive is enabled. These
responses are overridden at the proxy. Only the responses with status
codes of 4xx and 5xx are overridden in these updated packages.
* the default "/etc/logrotate.d/httpd" script incorrectly invoked the kill
command, instead of using the "/sbin/service httpd restart" command. If you
configured the httpd PID to be in a location other than
"/var/run/httpd.pid", the httpd logs failed to be rotated. This has been
resolved in these updated packages.
* the "ProxyTimeout" directive was not inherited across virtual host
definitions.
* the logresolve utility was unable to read lines longer the 1024 bytes.
This update adds the following enhancements:
* a new configuration option has been added, "ServerTokens Full-Release",
which adds the package release to the server version string, which is
returned in the "Server" response header.
* a new module has been added, mod_version, which allows configuration
files to be written containing sections, which are evaluated only if the
version of httpd used matches a specified condition.
Users of httpd are advised to upgrade to these updated packages, which
resolve these issues and add these enhancements.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
240024 - Mod_proxy_http ProxyErrorOverride eating cookies
240857 - [RFE] Apache does not report patch level when scanned
241680 - logrotate.d/httpd postrotate must use initscripts
245719 - mod_proxy configuration inheritance issue
245763 - long lines incorrectly handled by Apache's logresolve
250731 - CVE-2007-3847 httpd out of bounds read
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-11.el5.src.rpm
3ee6039a6aa2beeb14c55695c48cb6be httpd-2.2.3-11.el5.src.rpm
i386:
d734aeef038abf88bf4886911c124c7a httpd-2.2.3-11.el5.i386.rpm
b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm
86a4778fab59148114af83ba1eca224f mod_ssl-2.2.3-11.el5.i386.rpm
x86_64:
0030021cc1bc50b7c1d149f7c228d68a httpd-2.2.3-11.el5.x86_64.rpm
04c060ef39947d8a03756456fe013c31 httpd-debuginfo-2.2.3-11.el5.x86_64.rpm
fd20a69dc6b00651fae0d0d86511b867 mod_ssl-2.2.3-11.el5.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-11.el5.src.rpm
3ee6039a6aa2beeb14c55695c48cb6be httpd-2.2.3-11.el5.src.rpm
i386:
b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm
2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm
c994b3e5b0e2ff8102043792505c91d4 httpd-manual-2.2.3-11.el5.i386.rpm
x86_64:
b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm
04c060ef39947d8a03756456fe013c31 httpd-debuginfo-2.2.3-11.el5.x86_64.rpm
2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm
4603c4e041958a602c4bad393c90c6a7 httpd-devel-2.2.3-11.el5.x86_64.rpm
07e2c67b68e178bac107a3e61a929f23 httpd-manual-2.2.3-11.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-11.el5.src.rpm
3ee6039a6aa2beeb14c55695c48cb6be httpd-2.2.3-11.el5.src.rpm
i386:
d734aeef038abf88bf4886911c124c7a httpd-2.2.3-11.el5.i386.rpm
b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm
2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm
c994b3e5b0e2ff8102043792505c91d4 httpd-manual-2.2.3-11.el5.i386.rpm
86a4778fab59148114af83ba1eca224f mod_ssl-2.2.3-11.el5.i386.rpm
ia64:
c56a478f241fae66e5a98d9a7160c079 httpd-2.2.3-11.el5.ia64.rpm
384dbc9996ce2fd456639a40a34ac765 httpd-debuginfo-2.2.3-11.el5.ia64.rpm
505c228afa459feb3273e1cea8e2be82 httpd-devel-2.2.3-11.el5.ia64.rpm
401a8cbb5de0e8db47c2ddb0c8373525 httpd-manual-2.2.3-11.el5.ia64.rpm
fcec7364955523f2d57ccb51e43ad811 mod_ssl-2.2.3-11.el5.ia64.rpm
ppc:
487e19dc73a7f1243fc380ec848c9ed8 httpd-2.2.3-11.el5.ppc.rpm
7a754add4fefa8284bf113f064c0fcc7 httpd-debuginfo-2.2.3-11.el5.ppc.rpm
f119c96226df58f9d77a5a8c3c218f1f httpd-debuginfo-2.2.3-11.el5.ppc64.rpm
07427ada748e7b16d2561534a14a02cf httpd-devel-2.2.3-11.el5.ppc.rpm
4997b231b3653909aa8f09dfc4635345 httpd-devel-2.2.3-11.el5.ppc64.rpm
61b181d0f1bd39bbfa7909f1af0f5f12 httpd-manual-2.2.3-11.el5.ppc.rpm
2a9afa90dbde5d937b9c63b02ad86b8c mod_ssl-2.2.3-11.el5.ppc.rpm
s390x:
268a9c1257e6630d2630919609defbaf httpd-2.2.3-11.el5.s390x.rpm
1896c36a9bdefb2f024c3daea65673cc httpd-debuginfo-2.2.3-11.el5.s390.rpm
775f81a39195c275e76f6792d68c54a2 httpd-debuginfo-2.2.3-11.el5.s390x.rpm
2cca0b16331ad72d7187f5311e38d919 httpd-devel-2.2.3-11.el5.s390.rpm
bfadb9ae50a4f5f9f55a9c486afaf916 httpd-devel-2.2.3-11.el5.s390x.rpm
a88989c4b428cf512189c317e16eb70c httpd-manual-2.2.3-11.el5.s390x.rpm
0ada06035539671248eda54a10e4c654 mod_ssl-2.2.3-11.el5.s390x.rpm
x86_64:
0030021cc1bc50b7c1d149f7c228d68a httpd-2.2.3-11.el5.x86_64.rpm
b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm
04c060ef39947d8a03756456fe013c31 httpd-debuginfo-2.2.3-11.el5.x86_64.rpm
2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm
4603c4e041958a602c4bad393c90c6a7 httpd-devel-2.2.3-11.el5.x86_64.rpm
07e2c67b68e178bac107a3e61a929f23 httpd-manual-2.2.3-11.el5.x86_64.rpm
fd20a69dc6b00651fae0d0d86511b867 mod_ssl-2.2.3-11.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFHMeeOXlSAg2UNWIIRAt3CAJ9SzRJ46le8u4PIrBSKJ98BfXex1ACgh5Jz
YzFfXAfmtav4AgMh9VMGjrU=
=Kh5i
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRzJoASh9+71yA2DNAQKwswP+Pq9z0TvcBbkx+0E0s3tSulQN/Bwwoguy
SbMb0jqm5GEowFDSu0YhWa8/hSB9f9julSgC2xyShj7tL01f4dZmMKtcbU5OzDbH
13VtDZ7l42VNHAKZgWVCN9iGM8soFqwjwHuPVLzyJXJYXKLzqgsvjnqVC0k4hpkO
3/2HiBpyR1Q=
=ctb6
-----END PGP SIGNATURE-----