Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0281
PM80058: Potential exposure in several IBM HTTP Server optional modules
26 February 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: IBM HTTP Server
Publisher: IBM
Operating System: AIX
HP-UX
Linux variants
Solaris
Windows
Impact/Access: Cross-site Scripting -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2012-4558 CVE-2012-3499
Reference: ESB-2013.0280
Original Bulletin:
http://www-01.ibm.com/support/docview.wss?uid=swg1PM80058
- --------------------------BEGIN INCLUDED TEXT--------------------
PM80058: Potential exposure in several IBM HTTP Server optional modules
Document information
IBM HTTP Server
Runtime
Software version:
8.5
Reference #:
PM80058
Modified date:
2013-02-19
APAR status
Closed as program error.
Error description
This APAR resolves IHS vulnerabilities in several optional
modules.
Local fix
Problem summary
****************************************************************
* USERS AFFECTED: Users of IBM HTTP Server that use the *
* optional mod_info, mod_ldap, mod_status, *
* mod_imagemap, mod_proxy_ftp, or *
* mod_proxy_balancer modules. *
****************************************************************
* PROBLEM DESCRIPTION: XSS flaws due to unescaped hostnames *
* and URIs HTML output in several *
* optional IHS modules. *
****************************************************************
* RECOMMENDATION: Apply the fix. *
****************************************************************
Cross-site scripting vulnerabilities:
- CVE-2012-3499
- CVE-2012-4558
Problem conclusion
The affected modules were updated to resolve the exposures.
This fix is targeted for IBM HTTP Server fixpacks:
- 6.1.0.47
- 7.0.0.29
- 8.0.0.6
- 8.5.0.2
Temporary fix
Comments
APAR Information
APAR number PM80058
Reported component name IBM HTTP SERVER
Reported component ID 5724J0801
Reported release 850
Status CLOSED PER
PE NoPE
HIPER NoHIPER
Special Attention NoSpecatt
Submitted date 2013-01-07
Closed date 2013-02-19
Last modified date 2013-02-19
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name IBM HTTP SERVER
Fixed component ID 5724J0801
Applicable component levels
R61A PSY UP
R61H PSY UP
R61I PSY UP
R61P PSY UP
R61S PSY UP
R61W PSY UP
R61Z PSY UP
R700 PSY UP
R800 PSY UP
R850 PSY UP
Copyright and trademark information
IBM, the IBM logo and ibm.com are trademarks of International Business
Machines Corp., registered in many jurisdictions worldwide. Other product and
Service names might be trademarks of IBM or other companies. A current list of
IBM trademarks is available on the Web at "Copyright and trademark
information" at www.ibm.com/legal/copytrade.shtml.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUSwVpu4yVqjM2NGpAQLauRAAvZjx8GDocImXnZ3se4WBpWlG4+uAIC+l
snLc7aiJh/ifwLQQd5ynCPYueBu/2EH2KN74LrFKm3+NmaN/1dcTLaql7mwljGpm
ctSVN5qQLycvdvCugJlYbga7ON2zaY543t+SkJ0KP4VjE2zeBE36ij9Il9fsLeuc
+2YoFoSXrbKE6o3ha8+xJUEKuzH8Vh9tkt10WcfiEuVwQUvMrrixnYqAZ2AuepuO
1urykTyC0JyhVZNdA8ud4L4qoxE/CXRwCO7Elh4BT/b+0BZJ3iuv/Zi/9yEIT4Jf
6HRbNCtgTVF6bgOgdQdFrowycKptgEkbfPKfYkPXK+gPG4wR8TJjcNnD0w9AYxoB
cCQb5t9owSYqPRZ3PRSq0P5d2jqTpsdPDSMqYYcrWGDBz0/DGa1QyxB2Mmt/HWdV
SaF/XXfZLUsFjZJ6fUQKLin6zK/ffChTn1PIccybrK1YN9fFvOXQSLByyrvjL5c5
vcz4t5KdUeisLuGWcK1UIRUWEshNYbjJuftUkTf5fkTWsBZMPH18Ui5UccpJWSZh
fjXvz0uVQuSbS3636+7BfEW5vkOLVF/Glrq1QTNvG02cBGu3g973WxOb42PRCLLO
Ylt2+RJTJOEtaNP07di4x4hb46Xa5/cPoh6OIr+Dojt6AVGpy8PPBBtPb1q1VsCm
jZY+hJdM3yM=
=EYNC
-----END PGP SIGNATURE-----