Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

USN-860-1: Apache vulnerabilities

19 November 2009

Apache vulnerabilities

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

Details

Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3
protocols. If an attacker could perform a machine-in-the-middle attack at the
start of a TLS connection, the attacker could inject arbitrary content at
the beginning of the user's session. The flaw is with TLS renegotiation and
potentially affects any software that supports this feature. Attacks
against the HTTPS protocol are known, with the severity of the issue
depending on the safeguards used in the web application. Until the TLS
protocol and underlying libraries are adjusted to defend against this
vulnerability, a partial, temporary workaround has been applied to Apache
that disables client initiated TLS renegotiation. This update does not
protect against server initiated TLS renegotiation when using
SSLVerifyClient and SSLCipherSuite on a per Directory or Location basis.
Users can defend againt server inititiated TLS renegotiation attacks by
adjusting their Apache configuration to use SSLVerifyClient and
SSLCipherSuite only on the server or virtual host level. (CVE-2009-3555)

It was discovered that mod_proxy_ftp in Apache did not properly sanitize
its input when processing replies to EPASV and PASV commands. An attacker
could use this to cause a denial of service in the Apache child process.
(CVE-2009-3094)

Another flaw was discovered in mod_proxy_ftp. If Apache is configured as a
reverse proxy, an attacker could send a crafted HTTP header to bypass
intended access controls and send arbitrary commands to the FTP server.
(CVE-2009-3095)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10
Ubuntu 9.04
Ubuntu 8.10
Ubuntu 8.04
Ubuntu 6.06

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Related notices

  • USN-1010-1: openjdk-6-jre-headless, openjdk-6-jre, icedtea6-plugin, openjdk-6b18, openjdk-6, openjdk-6-jdk
  • USN-990-2: apache2.2-common, apache2, apache2-common
  • USN-990-1: libssl0.9.8, openssl
  • USN-923-1: openjdk-6-jre, openjdk-6-jre-lib, openjdk-6
  • USN-927-4: nss, libnss3-1d
  • USN-927-6: nss, libnss3-1d
  • USN-927-1: nss, libnss3-1d