Ubuntu 2152-1 Apache HTTP Server Crash: Denial Of Service Advisory

ubuntu

March 24, 2014

Apache HTTP server could be made to crash if it received specially crafted network traffic.

Summary

Apache HTTP server could be made to crash if it received specially crafted

network traffic.

Software Description:

- apache2: Apache HTTP server

Details:

Ning Zhang & Amin Tora discovered that the mod_dav module incorrectly

handled whitespace characters in CDATA sections. A remote attacker could

use this issue to cause the server to stop responding, resulting in a

denial of service. (CVE-2013-6438)

Rainer M Canavan discovered that the mod_log_config module incorrectly

handled certain cookies. A remote attacker could use this issue to cause

the server to stop responding, resulting in a denial of service. This issue

only affected Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10.

(CVE-2014-0098)

Topics Covered

security advisory denial of service security update software patch ubuntu apache http server

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  apache2.2-bin                   2.4.6-2ubuntu2.2

Ubuntu 12.10:
  apache2.2-bin                   2.2.22-6ubuntu2.4

Ubuntu 12.04 LTS:
  apache2.2-bin                   2.2.22-1ubuntu1.5

Ubuntu 10.04 LTS:
  apache2.2-bin                   2.2.14-5ubuntu8.13

In general, a standard system update will make all the necessary changes.