| |||||||||||||||||||
Ubuntu alert USN-1765-1 (apache2)
========================================================================== Ubuntu Security Notice USN-1765-1 March 18, 2013 apache2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.10 - Ubuntu 12.04 LTS - Ubuntu 11.10 - Ubuntu 10.04 LTS - Ubuntu 8.04 LTS Summary: Several security issues were fixed in the Apache HTTP Server. Software Description: - apache2: Apache HTTP server Details: Niels Heinen discovered that multiple modules incorrectly sanitized certain strings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. (CVE-2012-3499, CVE-2012-4558) It was discovered that the mod_proxy_ajp module incorrectly handled error states. A remote attacker could use this issue to cause the server to stop responding, resulting in a denial of service. This issue only applied to Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 11.10. (CVE-2012-4557) It was discovered that the apache2ctl script shipped in Ubuntu packages incorrectly created the lock directory. A local attacker could possibly use this issue to gain privileges. The symlink protections in Ubuntu 11.10 and later should reduce this vulnerability to a denial of service. (CVE-2013-1048) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.10: apache2.2-common 2.2.22-6ubuntu2.2 Ubuntu 12.04 LTS: apache2.2-common 2.2.22-1ubuntu1.3 Ubuntu 11.10: apache2.2-common 2.2.20-1ubuntu1.4 Ubuntu 10.04 LTS: apache2.2-common 2.2.14-5ubuntu8.11 Ubuntu 8.04 LTS: apache2.2-common 2.2.8-1ubuntu0.25 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1765-1 CVE-2012-3499, CVE-2012-4557, CVE-2012-4558, CVE-2013-1048 Package Information: https://launchpad.net/ubuntu/+source/apache2/2.2.22-6ubun... https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubun... https://launchpad.net/ubuntu/+source/apache2/2.2.20-1ubun... https://launchpad.net/ubuntu/+source/apache2/2.2.14-5ubun... https://launchpad.net/ubuntu/+source/apache2/2.2.8-1ubunt... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security... (Log in to post comments)
|
|||||||||||||||||||