GLSA 200807-06: Apache: Denial of Service

http://security.gentoo.org/

Severity:	normal
Title:	Apache: Denial of Service
Date:	07/09/2008
Bugs:	#222643, #227111
ID:	200807-06

Synopsis

Multiple vulnerabilities in Apache might lead to a Denial of Service.

Background

The Apache HTTP server is one of the most popular web servers on the Internet.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
www-servers/apache	< 2.2.9	>= 2.2.9	All supported architectures

Description

Multiple vulnerabilities have been discovered in Apache:

Dustin Kirkland reported that the mod_ssl module can leak memory when the client reports support for a compression algorithm (CVE-2008-1678).
Ryujiro Shibuya reported that the ap_proxy_http_process_response() function in the mod_proxy module does not limit the number of forwarded interim responses (CVE-2008-2364).
sp3x of SecurityReason reported a Cross-Site Request Forgery vulnerability in the balancer-manager in the mod_proxy_balancer module (CVE-2007-6420).

Impact

A remote attacker could exploit these vulnerabilities by connecting to an Apache httpd, by causing an Apache proxy server to connect to a malicious server, or by enticing a balancer administrator to connect to a specially-crafted URL, resulting in a Denial of Service of the Apache daemon.

Workaround

There is no known workaround at this time.

Resolution

All Apache users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.9"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200807-06.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.