Detalji
Kreirano: 26 Lipanj 2012
Otkriveni su višestruki nedostaci vezani uz Apache HTTP Server. Spomenute nedostatke udaljeni napadač može iskoristiti za dobivanje većih privilegija, zaobilaženje postavljenih ograničenja, DoS napad, otkivanje vrijednosti HTTPOnly kolačića te slanje zahtjeva pojedinim poslužiteljima. Lokalni napadač može iskoristiti nedostatke za povećanje ovlasti.
Paket:
Apache 2.x
Operacijski sustavi:
Gentoo Linux
Kritičnost:
7
Problem:
cjelobrojno prepisivanje, pogreška u programskoj funkciji, pogreška u programskoj komponenti
Iskorištavanje:
lokalno/udaljeno
Posljedica:
dobivanje većih privilegija, otkrivanje osjetljivih informacija, uskraćivanje usluga (DoS), zaobilaženje postavljenih ograničenja
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2010-0408, CVE-2010-0434, CVE-2010-1452, CVE-2010-2791, CVE-2011-3192, CVE-2011-3348, CVE-2011-3368, CVE-2011-3607, CVE-2011-4317, CVE-2012-0021, CVE-2012-0031, CVE-2012-0053, CVE-2012-0883
Izvorni ID preporuke:
GLSA 201206-25
Izvor:
Gentoo
Problem:
Neki od propusta posljedica su pogrešaka u funkcijama "ap_proxy_ajp_request", "ap_read_request", "ap_pregsub", "log_cookie", modulu "mod_proxy_ajp" i datoteci "protocol.c". Za detalje se preporuča čitanje teksta izvorne preporuke.
Posljedica:
Posljedice napada su otkrivanje osjetljivih informacija, povećanje ovlasti, zaobilaženje postavljenih ograničenja, izvođenje DoS napada, otkivanje vrijednosti HTTPOnly kolačića (eng. cookie) te slanje zahtjeva nenamjeravanim poslužiteljima.
Rješenje:
Za rješavanje problema, savjetuje se nadogradnja sustava izdanim osvježenim paketima.
Izvorni tekst preporuke
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201206-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Apache HTTP Server: Multiple vulnerabilities
Date: June 24, 2012
Bugs: #308049, #330195, #380475, #382971, #385859, #389353,
#392189, #398761, #401081, #412481
ID: 201206-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities were found in Apache HTTP Server.
Background
==========
Apache HTTP Server is one of the most popular web servers on the
Internet.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-servers/apache < 2.2.22-r1 >= 2.2.22-r1
Description
===========
Multiple vulnerabilities have been discovered in Apache HTTP Server.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker might obtain sensitive information, gain privileges,
send requests to unintended servers behind proxies, bypass certain
security restrictions, obtain the values of HTTPOnly cookies, or cause
a Denial of Service in various ways.
A local attacker could gain escalated privileges.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Apache HTTP Server users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.22-r1"
References
==========
[ 1 ] CVE-2010-0408
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0408
[ 2 ] CVE-2010-0434
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0434
[ 3 ] CVE-2010-1452
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1452
[ 4 ] CVE-2010-2791
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2791
[ 5 ] CVE-2011-3192
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3192
[ 6 ] CVE-2011-3348
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3348
[ 7 ] CVE-2011-3368
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3368
[ 8 ] CVE-2011-3607
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3607
[ 9 ] CVE-2011-4317
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4317
[ 10 ] CVE-2012-0021
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0021
[ 11 ] CVE-2012-0031
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0031
[ 12 ] CVE-2012-0053
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0053
[ 13 ] CVE-2012-0883
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0883
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201206-25.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Posljednje sigurnosne preporuke