USN-860-1: Apache vulnerabilities

Releases

• Ubuntu 9.10
• Ubuntu 9.04
• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 6.06

Packages

• apache2 -

Details

Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3
protocols. If an attacker could perform a machine-in-the-middle attack at the
start of a TLS connection, the attacker could inject arbitrary content at
the beginning of the user's session. The flaw is with TLS renegotiation and
potentially affects any software that supports this feature. Attacks
against the HTTPS protocol are known, with the severity of the issue
depending on the safeguards used in the web application. Until the TLS
protocol and underlying libraries are adjusted to defend against this
vulnerability, a partial, temporary workaround has been applied to Apache
that disables client initiated TLS renegotiation. This update does not
protect against server initiated TLS renegotiation when using
SSLVerifyClient and SSLCipherSuite on a per Directory or Location basis.
Users can defend againt server inititiated TLS renegotiation attacks by
adjusting their Apache configuration to use SSLVerifyClient and
SSLCipherSuite only on the server or virtual host level. (CVE-2009-3555)

It was discovered that mod_proxy_ftp in Apache did not properly sanitize
its input when processing replies to EPASV and PASV commands. An attacker
could use this to cause a denial of service in the Apache child process.
(CVE-2009-3094)

Another flaw was discovered in mod_proxy_ftp. If Apache is configured as a
reverse proxy, an attacker could send a crafted HTTP header to bypass
intended access controls and send arbitrary commands to the FTP server.
(CVE-2009-3095)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• apache2.2-common - 2.2.12-1ubuntu2.1

Ubuntu 9.04

• apache2.2-common - 2.2.11-2ubuntu2.5

Ubuntu 8.10

• apache2.2-common - 2.2.9-7ubuntu3.5

Ubuntu 8.04

• apache2.2-common - 2.2.8-1ubuntu0.14

Ubuntu 6.06

• apache2-common - 2.0.55-4ubuntu2.9

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2009-3094
• CVE-2009-3095
• CVE-2009-3555

Related notices

• USN-1010-1: openjdk-6-jre, openjdk-6-jre-headless, icedtea6-plugin, openjdk-6, openjdk-6-jdk, openjdk-6b18
• USN-990-2: apache2, apache2-common, apache2.2-common
• USN-990-1: openssl, libssl0.9.8
• USN-923-1: openjdk-6, openjdk-6-jre-lib, openjdk-6-jre
• USN-927-4: nss, libnss3-1d
• USN-927-6: nss, libnss3-1d
• USN-927-1: nss, libnss3-1d