Home / mailings

PDF

[USN-1627-1] Apache HTTP Server vulnerabilities

Posted on 08 November 2012
Ubuntu Security

==========================
==========================
========================
Ubuntu Security Notice USN-1627-1
November 08, 2012

apache2 vulnerabilities
==========================
==========================
========================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS

Summary:

Several security issues were fixed in the Apache HTTP server.

Software Description:
- apache2: Apache HTTP server

Details:

It was discovered that the mod_negotiation module incorrectly handled
certain filenames, which could result in browsers becoming vulnerable to
cross-site scripting attacks when processing the output. With cross-site
scripting vulnerabilities, if a user were tricked into viewing server
output during a crafted server request, a remote attacker could exploit
this to modify the contents, or steal confidential data (such as
passwords), within the same domain. (CVE-2012-2687)

It was discovered that the Apache HTTP Server was vulnerable to the "CRIM=
E"
SSL data compression attack. Although this issue had been mitigated on th=
e
client with newer web browsers, this update also disables SSL data
compression on the server. A new SSLCompression directive for Apache has
been backported that may be used to re-enable SSL data compression in
certain environments. For more information, please refer to:
http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcompression
(CVE-2012-4929)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
apache2.2-common 2.2.22-6ubuntu2.1

Ubuntu 12.04 LTS:
apache2.2-common 2.2.22-1ubuntu1.2

Ubuntu 11.10:
apache2.2-common 2.2.20-1ubuntu1.3

Ubuntu 10.04 LTS:
apache2.2-common 2.2.14-5ubuntu8.10

Ubuntu 8.04 LTS:
apache2.2-common 2.2.8-1ubuntu0.24

In general, a standard system update will make all the necessary changes.=


References:
http://www.ubuntu.com/usn/usn-1627-1
CVE-2012-2687, CVE-2012-4929

Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.2.22-6ubuntu2.1
https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.2
https://launchpad.net/ubuntu/+source/apache2/2.2.20-1ubuntu1.3
https://launchpad.net/ubuntu/+source/apache2/2.2.14-5ubuntu8.10
https://launchpad.net/ubuntu/+source/apache2/2.2.8-1ubuntu0.24



------------

 

TOP