Red Hat Security Advisory: httpd security and bug fix update
An update for the Apache HTTP Server component for JBoss Enterprise Web Server 1.0.2 that fixes multiple security issues and one bug is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-0053US | medium4.3 | Exploit | ||
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows r… | ||||
| CVE-2012-0021US | low2.6 | — | ||
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{… | ||||
| CVE-2012-0031US | medium4.6 | Exploit | ||
scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other imp… | ||||
| CVE-2011-3607US | medium4.4 | Exploit | ||
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allow… | ||||
| CVE-2011-3368US | medium5.0 | Exploit | ||
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) P… | ||||
| CVE-2011-3348US | medium4.3 | — | ||
The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2012:0543self
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=1.0.2external
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 736690external
- 740045external
- 769844external
- 773744external
- 785065external
remediations (7)
- FixedRed Hat JBoss Web Server 1.0
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2012:0543 - FixedRed Hat JBoss Web Server 1.0
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2012:0543 - FixedRed Hat JBoss Web Server 1.0
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2012:0543 - FixedRed Hat JBoss Web Server 1.0
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2012:0543 - FixedRed Hat JBoss Web Server 1.0
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2012:0543 - FixedRed Hat JBoss Web Server 1.0
The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect.
https://access.redhat.com/errata/RHSA-2012:0543 - WorkaroundRed Hat JBoss Web Server 1.0
As noted in the original reporter's advisory (see comment #5), this issue can be mitigated by using a custom ErrorDocument setting, such as: ErrorDocument 400 "Bad Request" http://httpd.apache.org/docs/2.2/mod/core.html#errordocument It should be noted that ErrorDocument setting using path or external URL does not mitigate this issue. It should also be noted that this is not an issue by itself. This can only be exploited via some other cross-site scripting (XSS) flaw found in a web application running on the server and may allow injected JavaScript to gain access to HttpOnly cookies, if the application uses this protection for its cookies.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan