Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1046
Moderate: httpd24-httpd security, bug fix, and enhancement update
27 April 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: httpd24
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-8743 CVE-2016-8740 CVE-2016-2161
CVE-2016-1546 CVE-2016-0736
Reference: ASB-2017.0058
ASB-2017.0021
ESB-2017.0127
ESB-2016.2860
Original Bulletin:
https://access.redhat.com/errata/RHSA-2017:1161
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: httpd24-httpd security, bug fix, and enhancement update
Advisory ID: RHSA-2017:1161-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2017:1161
Issue date: 2017-04-26
CVE Names: CVE-2016-0736 CVE-2016-1546 CVE-2016-2161
CVE-2016-8740 CVE-2016-8743
=====================================================================
1. Summary:
Updated httpd24 packages are now available as a part of Red Hat Software
Collections 2.4 for Red Hat Enterprise Linux.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
3. Description:
The Apache HTTP Server is a powerful, efficient, and extensible web server.
The httpd24 packages provide a recent stable release of version 2.4 of the
Apache HTTP Server, along with the mod_auth_kerb module.
The httpd24 Software Collection has been upgraded to version 2.4.25, which
provides a number of bug fixes and enhancements over the previous version.
For detailed changes, see the Red Hat Software Collections 2.4 Release
Notes linked from the References section. (BZ#1404778)
Security Fix(es):
* It was discovered that the mod_session_crypto module of httpd did not use
any mechanisms to verify integrity of the encrypted session data stored in
the user's browser. A remote attacker could use this flaw to decrypt and
modify session data using a padding oracle attack. (CVE-2016-0736)
* A denial of service flaw was found in httpd's mod_http2 module. A remote
attacker could use this flaw to block server threads for long times,
causing starvation of worker threads, by manipulating the flow control
windows on streams. (CVE-2016-1546)
* It was discovered that the mod_auth_digest module of httpd did not
properly check for memory allocation failures. A remote attacker could use
this flaw to cause httpd child processes to repeatedly crash if the server
used HTTP digest authentication. (CVE-2016-2161)
* It was discovered that the HTTP parser in httpd incorrectly allowed
certain characters not permitted by the HTTP protocol specification to
appear unencoded in HTTP request headers. If httpd was used in conjunction
with a proxy or backend server that interpreted those characters
differently, a remote attacker could possibly use this flaw to inject data
into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)
Note: The fix for the CVE-2016-8743 issue causes httpd to return "400 Bad
Request" error to HTTP clients which do not strictly follow HTTP protocol
specification. A newly introduced configuration directive
"HttpProtocolOptions Unsafe" can be used to re-enable the old less strict
parsing. However, such setting also re-introduces the CVE-2016-8743 issue.
* A vulnerability was found in httpd's handling of the LimitRequestFields
directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker
could send crafted requests with headers larger than the server's available
memory, causing httpd to crash. (CVE-2016-8740)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted
automatically.
5. Bugs fixed (https://bugzilla.redhat.com/):
1329639 - error in service httpd24-httpd configtest
1335616 - Backport Apache PR58118 to fix mod_proxy_fcgi spamming non-errors: AH01075: Error dispatching request to : (passing brigade to output filters)
1336350 - CVE-2016-1546 httpd: mod_http2 denial-of-service by thread starvation
1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2
1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto
1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest
1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects
1414037 - mod_proxy_fcgi regression in 2.4.23+
1432249 - must fail startup with conflicting Listen directives
1433474 - wrong requires of httpd24-httpd and httpd24-httpd-tools
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source:
httpd24-httpd-2.4.25-9.el6.src.rpm
noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm
x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source:
httpd24-httpd-2.4.25-9.el6.src.rpm
noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm
x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source:
httpd24-httpd-2.4.25-9.el6.src.rpm
noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm
x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
httpd24-httpd-2.4.25-9.el7.src.rpm
noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm
x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):
Source:
httpd24-httpd-2.4.25-9.el7.src.rpm
noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm
x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
httpd24-httpd-2.4.25-9.el7.src.rpm
noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm
x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-0736
https://access.redhat.com/security/cve/CVE-2016-1546
https://access.redhat.com/security/cve/CVE-2016-2161
https://access.redhat.com/security/cve/CVE-2016-8740
https://access.redhat.com/security/cve/CVE-2016-8743
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZAJq1XlSAg2UNWIIRAlGKAJ9zNHkvJQ9/I+imHbgRwjelvV9xKgCeLyYO
SjFZr+hN7gjeQOgcC0kswCY=
=m+ZH
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWQFaeIx+lLeg9Ub1AQjoUhAAkjQR8/d4oGBvjsNw+v9MCDHbMt0rCbyR
bKU7Fgts8OeZkU46qxum7dJGP9h7qsa3vHbO4h4LQfVsN37QmDdD/yjzf3tPIEPT
FEDl6BO8H0qtfOXciI/OlLVwRV0zI6Z4m6H7lVJ7uoT1EGDAJhVECki1n220Gwhg
L6fDum5JcuvYOXhTKd5S/cKW6wBQ1mCaBM6R8qOMGUSxgS9tdifj96EDn26FAgXh
k4gmx2xbrZWRjJd3QuzlF0Ow4P5jm5VBl78iGuKWqrg5ou5u0mbI7ROqEcZ0BcOq
qapQxfO6zJvpbGstNayiyok1DGTau8bTT9hs1OkLzia/GMj6OHdmI4dSfoCmeEVG
n8luM+KQSj5bfKvt77tP/AhSbEdRA4DQ9vwPALWkfbrt2UWXvvw3wVKCMI639zE6
MGFo43rgPME3Pb5YD6Ld+SLiS01eiuqlzrTXXrIMRWOIIo0hGQZlONV0GNhIIu8M
yBOW7s3egrkwmxSZdgmbvbhJigU5kCUgHEq9+TKfIEn4PucjHvMqaKRiP5CDVmWn
RK4psX5QD/tqXfii5NXz+tPT3wXu/D6c8SY7yh59Fion2ofeOWjcvVPHmDkDbEoM
0GQOBt/s/mb2GSMZqgh5tQrQVD0Nm0ytHLe7gs2ZcXUQUW5GVrv1aq38g0pg/9fG
jSZSAjvbtJ8=
=CpyU
-----END PGP SIGNATURE-----