Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0044
Low: httpd security, bug fix, and enhancement update
9 January 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: httpd
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux WS/Desktop 5
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Provide Misleading Information -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2012-2687 CVE-2008-0456 CVE-2008-0455
Reference: ESB-2012.1204
ESB-2012.0991
ESB-2012.0799
ESB-2009.0459
Original Bulletin:
https://rhn.redhat.com/errata/RHSA-2013-0130.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Low: httpd security, bug fix, and enhancement update
Advisory ID: RHSA-2013:0130-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-0130.html
Issue date: 2013-01-08
CVE Names: CVE-2008-0455 CVE-2008-0456 CVE-2012-2687
=====================================================================
1. Summary:
Updated httpd packages that fix multiple security issues, various bugs,
and add enhancements are now available for Red Hat Enterprise Linux 5.
The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
3. Description:
The httpd packages contain the Apache HTTP Server (httpd), which is the
namesake project of The Apache Software Foundation.
Input sanitization flaws were found in the mod_negotiation module. A remote
attacker able to upload or create files with arbitrary names in a directory
that has the MultiViews options enabled, could use these flaws to conduct
cross-site scripting and HTTP response splitting attacks against users
visiting the site. (CVE-2008-0455, CVE-2008-0456, CVE-2012-2687)
Bug fixes:
* Previously, no check was made to see if the
/etc/pki/tls/private/localhost.key file was a valid key prior to running
the "%post" script for the "mod_ssl" package. Consequently, when
/etc/pki/tls/certs/localhost.crt did not exist and "localhost.key" was
present but invalid, upgrading the Apache HTTP Server daemon (httpd) with
mod_ssl failed. The "%post" script has been fixed to test for an existing
SSL key. As a result, upgrading httpd with mod_ssl now proceeds as
expected. (BZ#752618)
* The "mod_ssl" module did not support operation under FIPS mode.
Consequently, when operating Red Hat Enterprise Linux 5 with FIPS mode
enabled, httpd failed to start. An upstream patch has been applied to
disable non-FIPS functionality if operating under FIPS mode and httpd now
starts as expected. (BZ#773473)
* Prior to this update, httpd exit status codes were not Linux Standard
Base (LSB) compliant. When the command "service httpd reload" was run and
httpd failed, the exit status code returned was "0" and not in the range 1
to 6 as expected. A patch has been applied to the init script and httpd now
returns "1" as an exit status code. (BZ#783242)
* Chunked Transfer Coding is described in RFC 2616. Previously, the
Apache server did not correctly handle a chunked encoded POST request with
a "chunk-size" or "chunk-extension" value of 32 bytes or more.
Consequently, when such a POST request was made the server did not respond.
An upstream patch has been applied and the problem no longer occurs.
(BZ#840845)
* Due to a regression, when mod_cache received a non-cacheable 304
response, the headers were served incorrectly. Consequently, compressed
data could be returned to the client without the cached headers to indicate
the data was compressed. An upstream patch has been applied to merge
response and cached headers before data from the cache is served to the
client. As a result, cached data is now correctly interpreted by the
client. (BZ#845532)
* In a proxy configuration, certain response-line strings were not handled
correctly. If a response-line without a "description" string was received
from the origin server, for a non-standard status code, such as the "450"
status code, a "500 Internal Server Error" would be returned to the client.
This bug has been fixed so that the original response line is returned to
the client. (BZ#853128)
Enhancements:
* The configuration directive "LDAPReferrals" is now supported in addition
to the previously introduced "LDAPChaseReferrals". (BZ#727342)
* The AJP support module for "mod_proxy", "mod_proxy_ajp", now supports the
"ProxyErrorOverride" directive. Consequently, it is now possible to
configure customized error pages for web applications running on a backend
server accessed via AJP. (BZ#767890)
* The "%posttrans" scriptlet which automatically restarts the httpd service
after a package upgrade can now be disabled. If the file
/etc/sysconfig/httpd-disable-posttrans exists, the scriptlet will not
restart the daemon. (BZ#833042)
* The output of "httpd -S" now includes configured alias names for each
virtual host. (BZ#833043)
* New certificate variable names are now exposed by "mod_ssl" using the
"_DN_userID" suffix, such as "SSL_CLIENT_S_DN_userID", which use the
commonly used object identifier (OID) definition of "userID", OID
0.9.2342.19200300.100.1.1. (BZ#840036)
All users of httpd are advised to upgrade to these updated packages, which
fix these issues and add these enhancements.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
5. Bugs fixed (http://bugzilla.redhat.com/):
727342 - LDAPChaseReferrals should be LDAPReferrals
752618 - mod_ssl post install script can cause failures
767890 - The mod_proxy_ajp lacks the ErrorOverride
773473 - [RHEL 5.7] Apache HTTP Server cannot start with mod_ssl when FIPS 140-2 mode enabled
783242 - service httpd reload return 0 when it fails
840845 - httpd fails in processing chunked requests with > 31 bytes chunk-size / -extension line
845532 - mod_cache regression in httpd 2.2.3-65: non-cacheable 304 responses serve bad data
850794 - CVE-2012-2687 CVE-2008-0455 httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled
879292 - CVE-2008-0456 httpd: mod_negotiation CRLF injection via untrusted file names in directories with MultiViews enabled
6. Package List:
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-74.el5.src.rpm
i386:
httpd-2.2.3-74.el5.i386.rpm
httpd-debuginfo-2.2.3-74.el5.i386.rpm
mod_ssl-2.2.3-74.el5.i386.rpm
x86_64:
httpd-2.2.3-74.el5.x86_64.rpm
httpd-debuginfo-2.2.3-74.el5.x86_64.rpm
mod_ssl-2.2.3-74.el5.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-74.el5.src.rpm
i386:
httpd-debuginfo-2.2.3-74.el5.i386.rpm
httpd-devel-2.2.3-74.el5.i386.rpm
httpd-manual-2.2.3-74.el5.i386.rpm
x86_64:
httpd-debuginfo-2.2.3-74.el5.i386.rpm
httpd-debuginfo-2.2.3-74.el5.x86_64.rpm
httpd-devel-2.2.3-74.el5.i386.rpm
httpd-devel-2.2.3-74.el5.x86_64.rpm
httpd-manual-2.2.3-74.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-74.el5.src.rpm
i386:
httpd-2.2.3-74.el5.i386.rpm
httpd-debuginfo-2.2.3-74.el5.i386.rpm
httpd-devel-2.2.3-74.el5.i386.rpm
httpd-manual-2.2.3-74.el5.i386.rpm
mod_ssl-2.2.3-74.el5.i386.rpm
ia64:
httpd-2.2.3-74.el5.ia64.rpm
httpd-debuginfo-2.2.3-74.el5.ia64.rpm
httpd-devel-2.2.3-74.el5.ia64.rpm
httpd-manual-2.2.3-74.el5.ia64.rpm
mod_ssl-2.2.3-74.el5.ia64.rpm
ppc:
httpd-2.2.3-74.el5.ppc.rpm
httpd-debuginfo-2.2.3-74.el5.ppc.rpm
httpd-debuginfo-2.2.3-74.el5.ppc64.rpm
httpd-devel-2.2.3-74.el5.ppc.rpm
httpd-devel-2.2.3-74.el5.ppc64.rpm
httpd-manual-2.2.3-74.el5.ppc.rpm
mod_ssl-2.2.3-74.el5.ppc.rpm
s390x:
httpd-2.2.3-74.el5.s390x.rpm
httpd-debuginfo-2.2.3-74.el5.s390.rpm
httpd-debuginfo-2.2.3-74.el5.s390x.rpm
httpd-devel-2.2.3-74.el5.s390.rpm
httpd-devel-2.2.3-74.el5.s390x.rpm
httpd-manual-2.2.3-74.el5.s390x.rpm
mod_ssl-2.2.3-74.el5.s390x.rpm
x86_64:
httpd-2.2.3-74.el5.x86_64.rpm
httpd-debuginfo-2.2.3-74.el5.i386.rpm
httpd-debuginfo-2.2.3-74.el5.x86_64.rpm
httpd-devel-2.2.3-74.el5.i386.rpm
httpd-devel-2.2.3-74.el5.x86_64.rpm
httpd-manual-2.2.3-74.el5.x86_64.rpm
mod_ssl-2.2.3-74.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2008-0455.html
https://www.redhat.com/security/data/cve/CVE-2008-0456.html
https://www.redhat.com/security/data/cve/CVE-2012-2687.html
https://access.redhat.com/security/updates/classification/#low
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2013 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFQ68TMXlSAg2UNWIIRApH8AJ9lf6CJcLnIK7D9siL6M2/OxR1argCeO7mh
/xD6DzmFPZw8MhY2CC19xag=
=mexo
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUO0Leu4yVqjM2NGpAQJh8w//XRMXOIcnGD0Sd9SCm2rKiFuwrZy1I2y6
DlBTzpyupT3x0B45eHQsjk0Z737uzVUK3KN7EnsXoZAEN2zmjrA1TRuj46parpOP
SS2T698xkMeKjNUewFw7Q0KsY6ouaYizfVQkc8qrOmLmhBV1DeheLFwrkLOHt7jj
xyWxivRn0/2JTdRhcrknu2hLeYjC08NfQh8xK12l5+Sez24sKHIdFHD8t+rlwLmU
AsOhK3JB886fxQ6mKahq3ziePK+0YAIHpegmoW01VTCAOSAsA2TrUxwFa1ooaBnw
gR07zNzHbQ2Lw1PzYDNWi0qSk7mWRaU7nqFv4lx/BXeG8nNIaQaVLVCrdVAMkOz3
zaOcp9DvCPDGTOXYloOVQltJQtyZcMF0fcLy1wOZ9gG/ulxRrVMU6rFTzab8X2yf
HwwyUwrkwTZVuPPXnwqv7reHJNOjupiOrerPUkJUuWIeo4C4WCd7PfDm1+qlLeru
HvdTr6UbqCfqxRAAoCaPJktA5l8ftBOO+MNjKzfgBiUX21mwjeTbBu7gHMwN8pr2
L8pVIXxBeCF9GVNRBAqG57Ygf46glrVFSBuKIp9Kwl0NeRjoUJIClJHMkJiRT4X/
Me+6VEUp+a/xyjoHgjZ8lLycnQiy17XGWtIqkuwUDYtgqflB8R8fQ/udJXM4AHCM
TNHNrAdC+pQ=
=qy/X
-----END PGP SIGNATURE-----