Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2253
Security Bulletin: Multiple vulnerabilities in IBM HTTP
Server used by WebSphere Application Server
29 June 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: WebSphere Application Server
Publisher: IBM
Operating System: AIX
HP-UX
Linux
Solaris
Windows
z/OS
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-26691 CVE-2021-26690
Reference: ESB-2021.2229
ESB-2021.2196
Original Bulletin:
https://www.ibm.com/support/pages/node/6467651
- --------------------------BEGIN INCLUDED TEXT--------------------
Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application
Server
Document Information
Document number : 6467651
Modified date : 28 June 2021
Product : IBM HTTP Server
Software version : 9.0
Operating system(s): AIX
HP-UX
Linux
Solaris
Windows
z/OS
Edition : Base,Enterprise,Advanced,Single Server,Network Deployment
Summary
There are multiple vulnerabilities in the IBM HTTP Server used by WebSphere
Application Server. This has been addressed.
Vulnerability Details
CVEID: CVE-2021-26691
DESCRIPTION: Apache HTTP Server is vulnerable to a heap-based buffer overflow,
caused by improper bounds checking by the mod_session. By sending a specially
crafted SessionHeader, a remote attacker could overflow a buffer and cause a
denial of service.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
203465 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2021-26690
DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by
a NULL pointer dereference. A remote attacker could exploit this vulnerability
using a specially crafted Cookie header handled by mod_session to cause the
system to crash.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/
203464 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Affected Products and Versions
This vulnerability affects the following version and release of IBM HTTP Server
(powered by Apache) component in all editions of WebSphere Application Server
and bundling products.
+--------------------+----------+
|Affected Product(s) |Version(s)|
+--------------------+----------+
|IBM HTTP Server |9.0 |
+--------------------+----------+
Remediation/Fixes
For IBM HTTP Server used by WebSphere Application Server:
For V9.0.0.0 through 9.0.0.10:
. Upgrade to minimal fix pack levels as required by interim fix and then apply
Interim Fix PH06010 .
- --OR--
. Apply Fix Pack 9.0.0.11 or later.
Additional interim fixes may be available and linked off the interim fix
download page.
Important Note
IBM strongly suggests that all System z customers be subscribed to the System z
Security Portal to receive the latest critical System z security and
integrity service. If you are not subscribed, see the instructions on the
System z Security web site. Security and integrity APARs and associated fixes
will
be posted to this portal. IBM suggests reviewing the CVSS scores and applying
all security or integrity fixes as soon as possible to minimize any potential
risk.
Workarounds and Mitigations
None
Acknowledgement
Change History
28 Jun 2021: Initial Publication
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYNquXuNLKJtyKPYoAQg2kxAAmdkhaRgMURPLal4E0BYoirKe8vZwhT1W
4YDUTOcnqYTI46B2ez0CDAjstA6sTPYahwWwgt+3Y8+0G/TkHdmsK4JLWTmwmg7l
buBRIbQ+CV85OzjTU8uiX9Sc5C9mLH24x0UJJB1x27dZpSDMkC2VRpNiVWZ8M1Wb
ExZ+ZOg2TnnitYGLpdrIs72TQPAqNGEXoB5qUJBDxWm5SPF5UEXG5gUqxkUMr2sq
6qkNydL5FMpDRsfa6IX2LySrRl+iMhRKq0S44uUYRACAfkLBc4V440/3IXjTjGoY
l2Rlry45fNVxoTV2n4eOSmH1Kk1tpa99+J8TbXhj3k89dSwhQ/o2IJZp3gebNPRE
HOQKbRsfL7KTHohDEITiEy9sg2YGpokR24iN080p9pzZ1VrNy1yfrJEC+UOoOPEH
Ah7IUMX7soBu2nwa3JRID9k0nBFp5lHLySBQEvq7OFCGJfkf1+NOJ/lETC4wrROM
NrycuJ/LooT2gB1Zuu3auOVtkfczq0yql0/TmbrczZCA6KBjMroy63Nf7KXv7P3x
5PzHLcY5EWqcAzcfspaxcv+h7t6UM2k4qsjwL85fFGHVsgHCNsXi3qhzmvxYM0An
+yEPiMsDi7k4pJ/ipNfqEMyxVpaPepPc2R4brLMwQyIGI3lh5bZ42GWtyABHazfZ
Cb3+DZ+qoao=
=0kmQ
-----END PGP SIGNATURE-----