Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Apache
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Apache
ID: USN-3937-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 18.10
Datum: Do, 4. April 2019, 18:58
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0217
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0196
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17189
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0220
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17199
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0211
Applikationen: Apache

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============4827966303864700347==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="gQiEiPWi5UbpyGpVCMZi8jFHmJvixBKpW"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--gQiEiPWi5UbpyGpVCMZi8jFHmJvixBKpW
Content-Type: multipart/mixed;
boundary="H0Tl2IPRHzoHdWZZMK27uoFUXTjcH3ti0";
protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <0c93f07d-c183-ffc8-3dc6-dfc5bd263467@canonical.com>
Subject: [USN-3937-1] Apache HTTP Server vulnerabilities

--H0Tl2IPRHzoHdWZZMK27uoFUXTjcH3ti0
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-3937-1
April 04, 2019

apache2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the Apache HTTP Server.

Software Description:
- apache2: Apache HTTP server

Details:

Charles Fol discovered that the Apache HTTP Server incorrectly handled the
scoreboard shared memory area. A remote attacker able to upload and run
scripts could possibly use this issue to execute arbitrary code with root
privileges. (CVE-2019-0211)

It was discovered that the Apache HTTP Server HTTP/2 module incorrectly
handled certain requests. A remote attacker could possibly use this issue
to cause the server to consume resources, leading to a denial of service.
This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
(CVE-2018-17189)

It was discovered that the Apache HTTP Server incorrectly handled session
expiry times. When used with mod_session_cookie, this may result in the
session expiry time to be ignored, contrary to expectations.
(CVE-2018-17199)

Craig Young discovered that the Apache HTTP Server HTTP/2 module
incorrectly handled certain requests. A remote attacker could possibly use
this issue to cause the server to process requests incorrectly. This issue
only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-0196)

Simon Kappel discovered that the Apache HTTP Server mod_auth_digest module
incorrectly handled threads. A remote attacker with valid credentials could
possibly use this issue to authenticate using another username, bypassing
access control restrictions. (CVE-2019-0217)

Bernhard Lorenz discovered that the Apache HTTP Server was inconsistent
when processing requests containing multiple consecutive slashes. This
could lead to directives such as LocationMatch and RewriteRule to perform
contrary to expectations. (CVE-2019-0220)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
apache2-bin 2.4.34-1ubuntu2.1

Ubuntu 18.04 LTS:
apache2-bin 2.4.29-1ubuntu4.6

Ubuntu 16.04 LTS:
apache2-bin 2.4.18-2ubuntu3.10

Ubuntu 14.04 LTS:
apache2-bin 2.4.7-1ubuntu4.22

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3937-1
CVE-2018-17189, CVE-2018-17199, CVE-2019-0196, CVE-2019-0211,
CVE-2019-0217, CVE-2019-0220

Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.34-1ubuntu2.1
https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.6
https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.10
https://launchpad.net/ubuntu/+source/apache2/2.4.7-1ubuntu4.22


--H0Tl2IPRHzoHdWZZMK27uoFUXTjcH3ti0--

--gQiEiPWi5UbpyGpVCMZi8jFHmJvixBKpW
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlymJqAACgkQZWnYVadE
vpPLJRAAt5oe8+biQRHvQer8vyOmMxIOP3qeMT6bgJrYC74mVL1OPOVMEVdRd3KU
txN0RULTNzzKgfCA6g9whEa1JcAgcu/rsGhpHvmxDyUH4ffsNu5XCmC0lmCXU0cj
Sy+8EMtjVKc4+YwjoIFORw9glKERYFlov6uFf8vd7YeIrqjOZT+TNZwavYi8ofr8
tUH9yk/gjspK6DUQHlLU1SACIOlyzzMeJZkJPWROFnW4/EXtRA48wZyTjqg49nI0
KvKb4xfwBU/rOPH98lZOlOTWw0L8wO09Smq1zzb2JXs9vbT6+yPgHM4JYvmjTBt1
0AsHd2yVWwsHJ0HvOfdX7MSoCGgajdGSnyy8rZ16XDpAvmjvZL7TZDmmxDW2a4VE
7y/j98KlSkorHTh0zAbwb2GzeIPTCwkwj975cAqHBwRMq5JcfIN9w6J3m7K5UXcB
kY+zm3/koL6X+EebTOFdag2OK8hTIiRlbRlrSFDd3w4ssuLljZA/RZHgyjQL3ROm
skNqOHikDP48rwFn84kIvYUj3JIsqBvXXOPXsPlIV55sU/HQLgQ6X5CfKV25L9yq
EY0mrVYwbj5BWLPLfUwM7TsVWSE8gmMRJrjDvPaeO4cS0xytFZimABK2gjWpgQc3
mD9CDVlwcHizpdbVj6EJQGgcVRgSm/46vHx15yBWTiFSvbp0dJ8=
=qPTm
-----END PGP SIGNATURE-----

--gQiEiPWi5UbpyGpVCMZi8jFHmJvixBKpW--


--===============4827966303864700347==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============4827966303864700347==--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung