Ubuntu 11.10: USN-1368-1 Critical Apache Server Exploits and Fixes

ubuntu

February 16, 2012

Several security issues were fixed in the Apache HTTP Server.

Summary

Several security issues were fixed in the Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

It was discovered that the Apache HTTP Server incorrectly handled the

SetEnvIf .htaccess file directive. An attacker having write access to a

.htaccess file may exploit this to possibly execute arbitrary code.

(CVE-2011-3607)

Prutha Parikh discovered that the mod_proxy module did not properly

interact with the RewriteRule and ProxyPassMatch pattern matches in the

configuration of a reverse proxy. This could allow remote attackers to

contact internal webservers behind the proxy that were not intended for

external exposure. (CVE-2011-4317)

Rainer Canavan discovered that the mod_log_config module incorrectly

handled a certain format string when used with a threaded MPM. A remote

attacker could exploit this to cause a denial of service via a specially-crafted cookie. This issue only affected Ubuntu 11.04 and 11.10.

(CVE-2012-0021)

It w...

Read the Full Advisory

Topics Covered

security advisory critical remote code execution doS apache2 unintended exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  apache2.2-common                2.2.20-1ubuntu1.2

Ubuntu 11.04:
  apache2.2-common                2.2.17-1ubuntu1.5

Ubuntu 10.10:
  apache2.2-common                2.2.16-1ubuntu3.5

Ubuntu 10.04 LTS:
  apache2.2-common                2.2.14-5ubuntu8.8

Ubuntu 8.04 LTS:
  apache2.2-common                2.2.8-1ubuntu0.23

In general, a standard system update will make all the necessary changes.