ESB-2018.1001 - [Debian] apache2: Multiple vulnerabilities 2018-04-04

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.1001
                          apache2 security update
                               4 April 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           apache2
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
                   Debian GNU/Linux 9
Impact/Access:     Overwrite Arbitrary Files      -- Remote/Unauthenticated      
                   Denial of Service              -- Remote/Unauthenticated      
                   Provide Misleading Information -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-1312 CVE-2018-1303 CVE-2018-1301
                   CVE-2018-1283 CVE-2017-15715 CVE-2017-15710

Reference:         ESB-2018.0881
                   ESB-2018.0845

Original Bulletin: 
   http://www.debian.org/security/2018/dsa-4164

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4164-1                   security@debian.org
https://www.debian.org/security/                           Stefan Fritsch
April 03, 2018                        https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : apache2
CVE ID         : CVE-2017-15710 CVE-2017-15715 CVE-2018-1283 CVE-2018-1301
                 CVE-2018-1303 CVE-2018-1312

Several vulnerabilities have been found in the Apache HTTPD server.

CVE-2017-15710

    Alex Nichols and Jakob Hirsch reported that mod_authnz_ldap, if
    configured with AuthLDAPCharsetConfig, could cause an of bound write
    if supplied with a crafted Accept-Language header. This could
    potentially be used for a Denial of Service attack.

CVE-2017-15715

    Elar Lang discovered that expression specified in <FilesMatch> could
    match '$' to a newline character in a malicious filename, rather
    than matching only the end of the filename. This could be exploited
    in environments where uploads of some files are are externally
    blocked, but only by matching the trailing portion of the filename.

CVE-2018-1283

    When mod_session is configured to forward its session data to CGI
    applications (SessionEnv on, not the default), a remote user could
    influence their content by using a "Session" header.

CVE-2018-1301

    Robert Swiecki reported that a specially crafted request could have
    crashed the Apache HTTP Server, due to an out of bound access after
    a size limit is reached by reading the HTTP header.

CVE-2018-1303

    Robert Swiecki reported that a specially crafted HTTP request header
    could have crashed the Apache HTTP Server if using
    mod_cache_socache, due to an out of bound read while preparing data
    to be cached in shared memory.

CVE-2018-1312

    Nicolas Daniels discovered that when generating an HTTP Digest
    authentication challenge, the nonce sent by mod_auth_digest to
    prevent reply attacks was not correctly generated using a
    pseudo-random seed. In a cluster of servers using a common Digest
    authentication configuration, HTTP requests could be replayed across
    servers by an attacker without detection.

For the oldstable distribution (jessie), these problems have been fixed
in version 2.4.10-10+deb8u12.

For the stable distribution (stretch), these problems have been fixed in
version 2.4.25-3+deb9u4.

We recommend that you upgrade your apache2 packages.

For the detailed security status of apache2 please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/apache2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlrDpChfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0TbeA/5Ac73NH0cpU8BbqrzN5BRCaMYnMWAYmJbpQ+QXoVkyWUyJJmX+/2mAoMZ
xeuVR5buOHyDfG1PbOVh8vf43OlDB6dss8OwGPb7aDiPeT5G4jpZ5HtGtH+VOZNj
t0S/EocZq0e+rHGxkx0d9s/vRyNP8kxhyH/bXBerrPv5otDboOlEXyNeHpoeGqWi
4HIavCRFrbdpU786tyYOZCz+Sl3I1veOXrfMe3flCpNgcs2mWYc3rlDZ8FSYyB0M
eIBHEInt64lhT7w9ZtFs5BaVekbHPMLdMSLKZY7WBB040W8bnHhs4aUCszCePw5/
3gG/TR5xWaAzqRBDh/m9HYvC91NzicoJSHEobrAXGRO2uFJQrF7cB9faGW0361VY
NJCBv+/csW3t73h8M+X530owtgYPEWJZWZLDYQuk+SX4aXMttW14U7qKbsrlK7Np
6VLhFk53C9OWvKkzGnloJ6NxSdpDPkSANmTSVzAk/2n5Lgml7h0kWSjhK9GYOL0x
ZI6cZtKmAoFUw+GASQW7nXH+2+h60OKi+W7+M5kW1zpnx8BFvfu3NjElRpEp5RgT
4vmtpcmY3xVduS12USxjHzhYjHDi4XOLXE2J7wWenvj5FRVYbAeBATD/pJEKLDnn
4Hqk2DLv9YYp8sCF0N7wne3pfqk27OudZ8W64c9AEz70NJaw5vs=
=lCvc
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWsRbgIx+lLeg9Ub1AQjl8A//UX/D2PzKuEXKE7n7Dz7A8Z0aSNFDm6GP
GbjL7uC1JngvgLIAXn+1E/K5cWBuEky4Hywn8/qXs3uWjtptmHmi+xeCzAFaGrne
Fae2o1FAeeSTAJktE38C3b63tzwDbefHiG5SdqN7tA1anPxT75xFU5D5IweMV7iI
TfjGLFJkWLgAQAOJ9QsMKd3jlvHL9lDqmLjjrouNQvZ/ROlKzgin44Kr9yUN9I/a
n+8p9/0GpA2TM6cUT0v3nB8GDrHxF1sF0hJxOFhE/whUBl2YN+70Y2YMALbZo3Ho
dxkAXnxhe3RxofAbMXWGp8pLKJE01cKHyvp6Tw+OIrmtkhumFkj8PL8ykUhD2D8p
o46Zw+fLpY3mGJ4ME8lDBGTHu2tGwTHOSEuuqCso57C3MaeGG2TOzYZ8I2p4zFer
nw5XMocDwd+6LS6g/CWzGluHsyif78SMJImfOHWXjrjQpLOJcg7dlvcvwQU9ZD1Y
ubPN0jZNnfmlzRuZk+mc42dopcmKQMBkMi7mqvpZQIaPC3k4QUADpRTTVeJxlzvl
PJ14vYcyFZa7jOJkesPQgq49bA+eHnTgMledn2diKH/9x00CoY8TerTxzbdbp/LB
IMT2IvVvwkdebvVIZlpjLgy5MUiu9Agp05nFNAV9kjx4n/4Fbd5NaMMMQFYWIoKb
MQMf6O9UoNI=
=EGtG
-----END PGP SIGNATURE-----

« Back to bulletins