Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0200
Moderate: httpd security update
22 February 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: httpd
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux WS/Desktop 5
Impact/Access: Unauthorised Access -- Remote/Unauthenticated
Access Privileged Data -- Existing Account
Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2012-0053 CVE-2012-0031 CVE-2011-3639
CVE-2011-3607
Reference: ASB-2011.0111
ESB-2012.0158
ESB-2012.0101
ESB-2011.1063
ESB-2011.1010
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2012-0323.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: httpd security update
Advisory ID: RHSA-2012:0323-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0323.html
Issue date: 2012-02-21
CVE Names: CVE-2011-3607 CVE-2011-3639 CVE-2012-0031
CVE-2012-0053
=====================================================================
1. Summary:
Updated httpd packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
3. Description:
The Apache HTTP Server is a popular web server.
It was discovered that the fix for CVE-2011-3368 (released via
RHSA-2011:1392) did not completely address the problem. An attacker could
bypass the fix and make a reverse proxy connect to an arbitrary server not
directly accessible to the attacker by sending an HTTP version 0.9 request.
(CVE-2011-3639)
The httpd server included the full HTTP header line in the default error
page generated when receiving an excessively long or malformed header.
Malicious JavaScript running in the server's domain context could use this
flaw to gain access to httpOnly cookies. (CVE-2012-0053)
An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way httpd performed substitutions in regular expressions. An
attacker able to set certain httpd settings, such as a user permitted to
override the httpd configuration for a specific directory using a
".htaccess" file, could use this flaw to crash the httpd child process or,
possibly, execute arbitrary code with the privileges of the "apache" user.
(CVE-2011-3607)
A flaw was found in the way httpd handled child process status information.
A malicious program running with httpd child process privileges (such as a
PHP or CGI script) could use this flaw to cause the parent httpd process to
crash during httpd service shutdown. (CVE-2012-0031)
All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon will be restarted automatically.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
752080 - CVE-2011-3639 httpd: http 0.9 request bypass of the reverse proxy vulnerability CVE-2011-3368 fix
769844 - CVE-2011-3607 httpd: ap_pregsub Integer overflow to buffer overflow
773744 - CVE-2012-0031 httpd: possible crash on shutdown due to flaw in scoreboard handling
785069 - CVE-2012-0053 httpd: cookie exposure due to error responses
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-63.el5_8.1.src.rpm
i386:
httpd-2.2.3-63.el5_8.1.i386.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm
mod_ssl-2.2.3-63.el5_8.1.i386.rpm
x86_64:
httpd-2.2.3-63.el5_8.1.x86_64.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.x86_64.rpm
mod_ssl-2.2.3-63.el5_8.1.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-63.el5_8.1.src.rpm
i386:
httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm
httpd-devel-2.2.3-63.el5_8.1.i386.rpm
httpd-manual-2.2.3-63.el5_8.1.i386.rpm
x86_64:
httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.x86_64.rpm
httpd-devel-2.2.3-63.el5_8.1.i386.rpm
httpd-devel-2.2.3-63.el5_8.1.x86_64.rpm
httpd-manual-2.2.3-63.el5_8.1.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-63.el5_8.1.src.rpm
i386:
httpd-2.2.3-63.el5_8.1.i386.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm
httpd-devel-2.2.3-63.el5_8.1.i386.rpm
httpd-manual-2.2.3-63.el5_8.1.i386.rpm
mod_ssl-2.2.3-63.el5_8.1.i386.rpm
ia64:
httpd-2.2.3-63.el5_8.1.ia64.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.ia64.rpm
httpd-devel-2.2.3-63.el5_8.1.ia64.rpm
httpd-manual-2.2.3-63.el5_8.1.ia64.rpm
mod_ssl-2.2.3-63.el5_8.1.ia64.rpm
ppc:
httpd-2.2.3-63.el5_8.1.ppc.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.ppc.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.ppc64.rpm
httpd-devel-2.2.3-63.el5_8.1.ppc.rpm
httpd-devel-2.2.3-63.el5_8.1.ppc64.rpm
httpd-manual-2.2.3-63.el5_8.1.ppc.rpm
mod_ssl-2.2.3-63.el5_8.1.ppc.rpm
s390x:
httpd-2.2.3-63.el5_8.1.s390x.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.s390.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.s390x.rpm
httpd-devel-2.2.3-63.el5_8.1.s390.rpm
httpd-devel-2.2.3-63.el5_8.1.s390x.rpm
httpd-manual-2.2.3-63.el5_8.1.s390x.rpm
mod_ssl-2.2.3-63.el5_8.1.s390x.rpm
x86_64:
httpd-2.2.3-63.el5_8.1.x86_64.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.i386.rpm
httpd-debuginfo-2.2.3-63.el5_8.1.x86_64.rpm
httpd-devel-2.2.3-63.el5_8.1.i386.rpm
httpd-devel-2.2.3-63.el5_8.1.x86_64.rpm
httpd-manual-2.2.3-63.el5_8.1.x86_64.rpm
mod_ssl-2.2.3-63.el5_8.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-3607.html
https://www.redhat.com/security/data/cve/CVE-2011-3639.html
https://www.redhat.com/security/data/cve/CVE-2012-0031.html
https://www.redhat.com/security/data/cve/CVE-2012-0053.html
https://access.redhat.com/security/updates/classification/#moderate
https://rhn.redhat.com/errata/RHSA-2011-1392.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2012 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFPRBwPXlSAg2UNWIIRAlvJAJ0TMniw4hLPlG+CAhF6cZd3RqTH3QCfVlvK
6HtbvIeYuOnRkg4sqECy22U=
=UZwj
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBT0RUFO4yVqjM2NGpAQLcyg/9EmkSTPXxCOruEnJm1bMcRoP0/tpwT+O6
QXyxVHwGDsvEtt9jpdKw6J3rg87BB0EbX09unepygweTAf6BvPjMZAY67LGJyf3r
xiJhxyPMJhM2aDrnOkE000pPIunwnshXzFdN9OYoq3tgIzAE7z6QRLFhDGc3CkPv
TFs+fk/Rc6n8oPdl8C68xx3iG53o7lJTO06HJKgOddxu0K4JWNi+9MLccObDhVQ1
o4nGKg+BEo7RYr755t5s1m2bBtdiN/h5NnJ9JFe+MZODxOrXMMWWCz1bC6aOr2IK
AuRHhi1+jYpqnyFM4EGj8IFZa61R5BU8soZ7hnqJ4gMrCInaZI1p80zjoR3cZdQU
U3wM+rEwJVCUeBwxKQF7CgWLNElB4QODkVe6qVGWzYNmawFtl0EEWjPkhkQPOAjG
u22z6zRI0VtIEjeOlovo+s7gI9PqIjOmoAU2kfmvgXU7/mKCsZd9byTmpubDGNEx
W0o3htX4QH8YXwDFiI29jAiyfLXGBAeDk6yFc6uaewDiHVnZdXJm2eWYwbUjT5x5
yU3+ZqBKWPSkJbQf2esOGXN0T3Z0XHpXlNLu7r3auzoA4mUaKWVQTfpdFraut5F0
a9qtYCXGcyde44HSQzQp0XMG0+lUKwKx2OObgZ4IpWn9vjB7LgZb/5kCWoOk7ZN/
egcRKMRfFKc=
=b5Oi
-----END PGP SIGNATURE-----