Ubuntu 13.04: USN-1903-1 Critical: Apache Server Command Injection

ubuntu

July 15, 2013

Several security issues were fixed in the Apache HTTP Server.

Summary

Several security issues were fixed in the Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

It was discovered that the mod_rewrite module incorrectly sanitized non-printable characters before writing data to log files. A remote attacker

could possibly use this flaw to execute arbitrary commands by injecting

escape sequences in the log file. (CVE-2013-1862)

It was discovered that the mod_dav module incorrectly handled certain MERGE

requests. A remote attacker could use this issue to cause the server to

stop responding, resulting in a denial of service. (CVE-2013-1896)

Topics Covered

security advisory denial of service remote attack Ubuntu update instructions command injection apache2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  apache2.2-common                2.2.22-6ubuntu5.1

Ubuntu 12.10:
  apache2.2-common                2.2.22-6ubuntu2.3

Ubuntu 12.04 LTS:
  apache2.2-common                2.2.22-1ubuntu1.4

Ubuntu 10.04 LTS:
  apache2.2-common                2.2.14-5ubuntu8.12

In general, a standard system update will make all the necessary changes.