Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.71125
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2012:0323
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2012:0323.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via
RHSA-2011:1392) did not completely address the problem. An attacker could
bypass the fix and make a reverse proxy connect to an arbitrary server not
directly accessible to the attacker by sending an HTTP version 0.9 request.
(CVE-2011-3639)

The httpd server included the full HTTP header line in the default error
page generated when receiving an excessively long or malformed header.
Malicious JavaScript running in the server's domain context could use this
flaw to gain access to httpOnly cookies. (CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was
found in the way httpd performed substitutions in regular expressions. An
attacker able to set certain httpd settings, such as a user permitted to
override the httpd configuration for a specific directory using a
.htaccess file, could use this flaw to crash the httpd child process or,
possibly, execute arbitrary code with the privileges of the apache user.
(CVE-2011-3607)

A flaw was found in the way httpd handled child process status information.
A malicious program running with httpd child process privileges (such as a
PHP or CGI script) could use this flaw to cause the parent httpd process to
crash during httpd service shutdown. (CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon will be restarted automatically.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2012-0323.html

Risk factor : Medium

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2011-3607
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
BugTraq ID: 50494
http://www.securityfocus.com/bid/50494
Debian Security Information: DSA-2405 (Google Search)
http://www.debian.org/security/2012/dsa-2405
http://archives.neohapsis.com/archives/fulldisclosure/2011-11/0023.html
HPdes Security Advisory: HPSBMU02748
http://marc.info/?l=bugtraq&m=133294460209056&w=2
HPdes Security Advisory: HPSBMU02786
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
HPdes Security Advisory: HPSBOV02822
http://marc.info/?l=bugtraq&m=134987041210674&w=2
HPdes Security Advisory: HPSBUX02761
http://marc.info/?l=bugtraq&m=133494237717847&w=2
HPdes Security Advisory: SSRT100772
HPdes Security Advisory: SSRT100823
HPdes Security Advisory: SSRT100877
HPdes Security Advisory: SSRT100966
http://www.mandriva.com/security/advisories?name=MDVSA-2012:003
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/
http://www.halfdog.net/Security/2011/ApacheModSetEnvIfIntegerOverflow/DemoExploit.html
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
http://www.osvdb.org/76744
RedHat Security Advisories: RHSA-2012:0128
http://rhn.redhat.com/errata/RHSA-2012-0128.html
RedHat Security Advisories: RHSA-2012:0542
http://rhn.redhat.com/errata/RHSA-2012-0542.html
RedHat Security Advisories: RHSA-2012:0543
http://rhn.redhat.com/errata/RHSA-2012-0543.html
http://securitytracker.com/id?1026267
http://secunia.com/advisories/45793
http://secunia.com/advisories/48551
XForce ISS Database: apache-http-appregsub-bo(71093)
https://exchange.xforce.ibmcloud.com/vulnerabilities/71093
Common Vulnerability Exposure (CVE) ID: CVE-2011-3639
Common Vulnerability Exposure (CVE) ID: CVE-2012-0031
BugTraq ID: 51407
http://www.securityfocus.com/bid/51407
http://www.mandriva.com/security/advisories?name=MDVSA-2012:012
http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/
https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8@%3Ccvs.httpd.apache.org%3E
http://secunia.com/advisories/47410
SuSE Security Announcement: SUSE-SU-2012:0323 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00002.html
SuSE Security Announcement: openSUSE-SU-2012:0314 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00026.html
Common Vulnerability Exposure (CVE) ID: CVE-2012-0053
BugTraq ID: 51706
http://www.securityfocus.com/bid/51706
HPdes Security Advisory: HPSBMU02776
http://marc.info/?l=bugtraq&m=133951357207000&w=2
HPdes Security Advisory: HPSBST02848
http://marc.info/?l=bugtraq&m=136441204617335&w=2
HPdes Security Advisory: SSRT100852
HPdes Security Advisory: SSRT101112
Common Vulnerability Exposure (CVE) ID: CVE-2011-3368
AIX APAR: SE49723
http://www-01.ibm.com/support/docview.wss?uid=nas2064c7e5f53452ff686257927003c8d42
AIX APAR: SE49724
http://www-01.ibm.com/support/docview.wss?uid=nas2b7c57b1f1035675186257927003c8d48
BugTraq ID: 49957
http://www.securityfocus.com/bid/49957
http://www.exploit-db.com/exploits/17969
http://seclists.org/fulldisclosure/2011/Oct/232
http://seclists.org/fulldisclosure/2011/Oct/273
http://www.mandriva.com/security/advisories?name=MDVSA-2011:144
http://www.contextis.com/research/blog/reverseproxybypass/
http://web.archiveorange.com/archive/v/ZyS0hzECD5zzb2NkvQlt
https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e@%3Ccvs.httpd.apache.org%3E
http://osvdb.org/76079
http://www.redhat.com/support/errata/RHSA-2011-1391.html
http://www.redhat.com/support/errata/RHSA-2011-1392.html
http://www.securitytracker.com/id?1026144
http://secunia.com/advisories/46288
http://secunia.com/advisories/46414
SuSE Security Announcement: SUSE-SU-2011:1229 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00011.html
SuSE Security Announcement: openSUSE-SU-2013:0243 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html
SuSE Security Announcement: openSUSE-SU-2013:0248 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html
XForce ISS Database: apache-modproxy-information-disclosure(70336)
https://exchange.xforce.ibmcloud.com/vulnerabilities/70336
CopyrightCopyright (c) 2012 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.