drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in Apache
Name: |
Mehrere Probleme in Apache |
|
ID: |
USN-1765-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 11.10, Ubuntu 12.04 LTS, Ubuntu 12.10 |
|
Datum: |
Mo, 18. März 2013, 23:38 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4557
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1048 |
|
Applikationen: |
Apache |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --===============6003487448411246187== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="------------enig28A83DE2C40C56CCF62B71A4"
This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig28A83DE2C40C56CCF62B71A4 Content-Type: text/plain; charset=ISO-8859- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-1765-1 March 18, 2013
apache2 vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in the Apache HTTP Server.
Software Description: - apache2: Apache HTTP server
Details:
Niels Heinen discovered that multiple modules incorrectly sanitized certain strings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. (CVE-2012-3499, CVE-2012-4558)
It was discovered that the mod_proxy_ajp module incorrectly handled error states. A remote attacker could use this issue to cause the server to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 11.10. (CVE-2012-4557)
It was discovered that the apache2ctl script shipped in Ubuntu packages incorrectly created the lock directory. A local attacker could possibly use this issue to gain privileges. The symlink protections in Ubuntu 11.10 and later should reduce this vulnerability to a denial of service. (CVE-2013-1048)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 12.10: apache2.2-common 2.2.22-6ubuntu2.2
Ubuntu 12.04 LTS: apache2.2-common 2.2.22-1ubuntu1.3
Ubuntu 11.10: apache2.2-common 2.2.20-1ubuntu1.4
Ubuntu 10.04 LTS: apache2.2-common 2.2.14-5ubuntu8.11
Ubuntu 8.04 LTS: apache2.2-common 2.2.8-1ubuntu0.25
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-1765-1 CVE-2012-3499, CVE-2012-4557, CVE-2012-4558, CVE-2013-1048
Package Information: https://launchpad.net/ubuntu/+source/apache2/2.2.22-6ubuntu2.2 https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.3 https://launchpad.net/ubuntu/+source/apache2/2.2.20-1ubuntu1.4 https://launchpad.net/ubuntu/+source/apache2/2.2.14-5ubuntu8.11 https://launchpad.net/ubuntu/+source/apache2/2.2.8-1ubuntu0.25
--------------enig28A83DE2C40C56CCF62B71A4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/
iQIcBAEBCgAGBQJRRxisAAoJEGVp2FWnRL6TJ2wP/jIyWMzKtNBd7zQAzCUPwFq0 1CbIjrVsDp3toC3ai5aE4BxinJyb1raMAEez/5wfr0UgXVyG/PmYN5KD+TYJmVCq tQecnK221EmnRWIckZSYTALJ3kzWYsXuRHndyfJc/yh6n/xnJBWycV1ZlQKzoamO IArQSFjRHC91Du+0mKwEPdlCS6BQ1Y/Rh5ES2Zi7Ckjqi4QW4tB8GASdksvujktp +UGef+WRHpbOzh7a3u4CEfTzs4P1M6O75HrkIEBFcIBKKgGDdJ8D5FkQO4ZW8dMt Qa0v0Tt0Gz2ASjsZUNIrRoscs0xgbwuoBq2lpFIKjAGUw/djtKW/3zaBbRNIVJVH x+JYUPpUnO2T6xYiFwMkF5KnhPvAQpxdhaWy5oi71XbDyTEI0eUi87stbSbg+7hu JjZjVjj60u8gyqpHOE7b8wq+RQRT2C7Xcmv5yyc2KKs4n/gXN+oRMdehpmOd6H2n vB7RsUC7kkbGJh3CB2luj5eWSLSBWlyyqynrKW9yG1MD4on+M5r8VN7BNd/52+Bs K48ObnTuvGMvZJ5T/6pFTKCiFjPAP+eFv9iKTOthadDwUY6ogjETYcIbgEDMcTl0 gNx//y7tBlqGGQqmbnFQG5PBEer/JzStXS2yIQVQQ8LnKHqT+CXpqyBLFl4u9d6E hJ3P/Fuc5t3PxMdV21TR =ulzH -----END PGP SIGNATURE-----
--------------enig28A83DE2C40C56CCF62B71A4--
--===============6003487448411246187== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============6003487448411246187==--
|
|
|
|