Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 512
Alerts This Week
Warning Icon 1 512

Red Hat 6 RHSA-2013:0512-02 Low: Security Update for Httpd Server

red hat
Calendar Grey February 21, 2013
Scroller Redhat
Keep abreast of the newest developments concerning Red Hat's low severity httpd advisory, which covers security vulnerabilities and improvements.
Updated httpd packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Summary

The httpd packages contain the Apache HTTP Server (httpd), which is the namesake project of The Apache Software Foundation.
An input sanitization flaw was found in the mod_negotiation Apache HTTP Server module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use this flaw to conduct cross-site scripting attacks against usersvisiting the site. (CVE-2008-0455, CVE-2012-2687)
It was discovered that mod_proxy_ajp, when used in configurations with mod_proxy in load balancer mode, would mark a back-end server as failed when request processing timed out, even when a previous AJP (Apache JServ Protocol) CPing request was responded to by the back-end. A remote attacker able to make a back-end use an excessive amount of time to process a request could cause mod_proxy to not send requests to back-end AJP servers for the retry timeout period or until all back-end serverswere marked as failed. (CVE-2012-4557)
These updated httpd packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Usersare directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes.
All users of httpd are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing the updated packages, the httpd daemon will be restarted automatically.

Topics%20covered

Topics Covered

security advisory security issue update bug fix Red Hat Enterprise Linux httpd low

References

https://access.redhat.com/security/cve/CVE-2008-0455 https://access.redhat.com/security/cve/CVE-2012-2687 https://access.redhat.com/security/cve/CVE-2012-4557 https://access.redhat.com/security/updates/classification#low

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source:
i386: httpd-2.2.15-26.el6.i686.rpm httpd-debuginfo-2.2.15-26.el6.i686.rpm httpd-tools-2.2.15-26.el6.i686.rpm
x86_64: httpd-2.2.15-26.el6.x86_64.rpm httpd-debuginfo-2.2.15-26.el6.x86_64.rpm httpd-tools-2.2.15-26.el6.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
i386: httpd-debuginfo-2.2.15-26.el6.i686.rpm httpd-devel-2.2.15-26.el6.i686.rpm mod_ssl-2.2.15-26.el6.i686.rpm
noarch: httpd-manual-2.2.15-26.el6.noarch.rpm
x86_64: httpd-debuginfo-2.2.15-26.el6.i686.rpm httpd-debuginfo-2.2.15-26.el6.x86_64.rpm httpd-devel-2.2.15-26.el6.i686.rpm httpd-devel-2.2.15-26.el6.x86_64.rpm mod_ssl-2.2.15-26.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
x86_64: httpd-2.2.15-26.el6.x86_64.rpm httpd-debuginfo-2.2.15-26.el6.x86_64.rpm httpd-tools-2.2.15-26.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
noarch: httpd-manual-2.2.15-26.el6.noarch.rpm
x86_64: httpd-debuginfo-2.2.15-26.el6.i686.rpm httpd-debuginfo-2.2.15-26.el6.x86_64.rpm httpd-devel-2.2.15-26.el6.i686.rpm httpd-devel-2.2.15-26.el6.x86_64.rpm mod_ssl-2.2.15-26.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
i386: httpd-2.2.15-26.el6.i686.rpm httpd-debuginfo-2.2.15-26.el6.i686.rpm

Read the Full Advisory


Severity
low
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2013:0512-02
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2013:0512.html
Issue date: 2013-02-21

Topic

Updated httpd packages that fix two security issues, several bugs, and addvarious enhancements are now available for Red Hat Enterprise Linux 6.The Red Hat Security Response Team has rated this update as having lowsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Topics%20covered

Topics Covered

security advisory security issue update bug fix Red Hat Enterprise Linux httpd low

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64

Bugs Fixed

757735 - [RFE] httpd's rotatelogs needs a way to rotate files into a custom location

757739 - [RFE] rotatelogs needs to create files even if they are empty

805720 - Only a single interface is available for SSL

805810 - init script for htcacheclean is missing

828896 - mod_authnz_ldap unable to set environment variables for authorize only

829689 - mod_ldap: fix occasional 500 Internal Server Error

842376 - httpd fails in processing chunked requests with > 31 bytes chunk-size / -extension line

848954 - Putting private key first in SSLProxyMachineCertificateFile causes segfault

850794 - CVE-2012-2687 CVE-2008-0455 httpd: mod_negotiation XSS via untrusted file names in directories with MultiViews enabled

867745 - mod_ssl post install script can cause failures

868283 - mod_cache regression in httpd 2.2.3-65: non-cacheable 304 responses serve bad data

871685 - CVE-2012-4557 httpd: mod_proxy_ajp worker moved to error state when timeout exceeded

876923 - "if" condition always true - detected by Coverity

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.