Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Ubuntu 16.10 USN-3279-1 Critical: Apache HTTP Server Denial of Service

ubuntu
Calendar Grey May 9, 2017
Dist Ubuntu Esm H88
The Ubuntu Security Notice USN-3279-1 highlights significant vulnerabilities in Apache and provides necessary updates to bolster security.
Several security issues were fixed in Apache HTTP Server.

Summary

Several security issues were fixed in Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

It was discovered that the Apache mod_session_crypto module was encrypting

data and cookies using either CBC or ECB modes. A remote attacker could

possibly use this issue to perform padding oracle attacks. (CVE-2016-0736)

Maksim Malyutin discovered that the Apache mod_auth_digest module

incorrectly handled malicious input. A remote attacker could possibly use

this issue to cause Apache to crash, resulting in a denial of service.

(CVE-2016-2161)

David Dennerline and Régis Leroy discovered that the Apache HTTP Server

incorrectly handled unusual whitespace when parsing requests, contrary to

specifications. When being used in combination with a proxy or backend

server, a remote attacker could possibly use this issue to perform an

injection attack and pollute cache. This update may introduce compatibility

issues with clients that do not stric...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical software update Ubuntu apache2 injection attack

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  apache2-bin                     2.4.18-2ubuntu4.1

Ubuntu 16.04 LTS:
  apache2-bin                     2.4.18-2ubuntu3.2

Ubuntu 14.04 LTS:
  apache2-bin                     2.4.7-1ubuntu4.14

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3279-1

CVE-2016-0736, CVE-2016-2161, CVE-2016-8743

Severity
critical
Lowest
Low
Medium
High
Critical

May 09, 2017

Topics%20covered

Topics Covered

security advisory denial of service critical software update Ubuntu apache2 injection attack

Package Information

https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu4.1
https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.2
https://launchpad.net/ubuntu/+source/apache2/2.4.7-1ubuntu4.14

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.