__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN httpd Security Update [Red Hat RHSA-2007:0746-8] November 7, 2007 18:00 GMT Number S-039 [REVISED 16 Nov 2007] [REVISED 23 Jan 2008] ______________________________________________________________________________ PROBLEM: A flaw was found in the Apache HTTP Server mod_proxy module. PLATFORM: RHEL Desktop Workstation (v. 5 client) Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux Desktop (v. 5 client) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS, ES, WS (v. 4) DAMAGE: A remote attacker could cause a denial of service if using a threaded Multi-Processing Module. SOLUTION: Upgrade to the appropriate version. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. On sites where a reverse proxy is ASSESSMENT: configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/s-039.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2007-0746.html ADDITIONAL LINKS: https://rhn.redhat.com/errata/RHSA-2007-0747.html http://www.securityfocus.com/bid/25489 CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2007-3847 ______________________________________________________________________________ REVISION HISTORY: 11/16/2007 - revised S-039 to add a link to Red Hat RHSA-2007:0747-6 for Red Hat Desktop (v. 4), Red Hat Enterprise Linux AS, ES, WS (v. 4). 01/23/2008 - revised S-039 to add a link to Security Focus 25489. [***** Start Red Hat RHSA-2007:0746-8 *****] Moderate: httpd security, bug fix, and enhancement update Advisory: RHSA-2007:0746-8 Type: Security Advisory Severity: Moderate Issued on: 2007-11-07 Last updated on: 2007-11-07 Affected Products: RHEL Desktop Workstation (v. 5 client) Red Hat Enterprise Linux (v. 5 server) Red Hat Enterprise Linux Desktop (v. 5 client) OVAL: com.redhat.rhsa-20070746.xml CVEs (cve.mitre.org): CVE-2007-3847 Details Updated httpd packages that fix a security issue, fix various bugs, and add enhancements, are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-3847) As well, these updated packages fix the following bugs: * Set-Cookie headers with a status code of 3xx are not forwarded to clients when the "ProxyErrorOverride" directive is enabled. These responses are overridden at the proxy. Only the responses with status codes of 4xx and 5xx are overridden in these updated packages. * the default "/etc/logrotate.d/httpd" script incorrectly invoked the kill command, instead of using the "/sbin/service httpd restart" command. If you configured the httpd PID to be in a location other than "/var/run/httpd.pid", the httpd logs failed to be rotated. This has been resolved in these updated packages. * the "ProxyTimeout" directive was not inherited across virtual host definitions. * the logresolve utility was unable to read lines longer the 1024 bytes. This update adds the following enhancements: * a new configuration option has been added, "ServerTokens Full-Release", which adds the package release to the server version string, which is returned in the "Server" response header. * a new module has been added, mod_version, which allows configuration files to be written containing sections, which are evaluated only if the version of httpd used matches a specified condition. Users of httpd are advised to upgrade to these updated packages, which resolve these issues and add these enhancements. Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 Updated packages RHEL Desktop Workstation (v. 5 client) -------------------------------------------------------------------------------- IA-32: httpd-devel-2.2.3-11.el5.i386.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-manual-2.2.3-11.el5.i386.rpm c994b3e5b0e2ff8102043792505c91d4 x86_64: httpd-devel-2.2.3-11.el5.i386.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.x86_64.rpm 4603c4e041958a602c4bad393c90c6a7 httpd-manual-2.2.3-11.el5.x86_64.rpm 07e2c67b68e178bac107a3e61a929f23 Red Hat Enterprise Linux (v. 5 server) -------------------------------------------------------------------------------- SRPMS: httpd-2.2.3-11.el5.src.rpm 3ee6039a6aa2beeb14c55695c48cb6be IA-32: httpd-2.2.3-11.el5.i386.rpm d734aeef038abf88bf4886911c124c7a httpd-devel-2.2.3-11.el5.i386.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-manual-2.2.3-11.el5.i386.rpm c994b3e5b0e2ff8102043792505c91d4 mod_ssl-2.2.3-11.el5.i386.rpm 86a4778fab59148114af83ba1eca224f IA-64: httpd-2.2.3-11.el5.ia64.rpm c56a478f241fae66e5a98d9a7160c079 httpd-devel-2.2.3-11.el5.ia64.rpm 505c228afa459feb3273e1cea8e2be82 httpd-manual-2.2.3-11.el5.ia64.rpm 401a8cbb5de0e8db47c2ddb0c8373525 mod_ssl-2.2.3-11.el5.ia64.rpm fcec7364955523f2d57ccb51e43ad811 PPC: httpd-2.2.3-11.el5.ppc.rpm 487e19dc73a7f1243fc380ec848c9ed8 httpd-devel-2.2.3-11.el5.ppc.rpm 07427ada748e7b16d2561534a14a02cf httpd-devel-2.2.3-11.el5.ppc64.rpm 4997b231b3653909aa8f09dfc4635345 httpd-manual-2.2.3-11.el5.ppc.rpm 61b181d0f1bd39bbfa7909f1af0f5f12 mod_ssl-2.2.3-11.el5.ppc.rpm 2a9afa90dbde5d937b9c63b02ad86b8c s390x: httpd-2.2.3-11.el5.s390x.rpm 268a9c1257e6630d2630919609defbaf httpd-devel-2.2.3-11.el5.s390.rpm 2cca0b16331ad72d7187f5311e38d919 httpd-devel-2.2.3-11.el5.s390x.rpm bfadb9ae50a4f5f9f55a9c486afaf916 httpd-manual-2.2.3-11.el5.s390x.rpm a88989c4b428cf512189c317e16eb70c mod_ssl-2.2.3-11.el5.s390x.rpm 0ada06035539671248eda54a10e4c654 x86_64: httpd-2.2.3-11.el5.x86_64.rpm 0030021cc1bc50b7c1d149f7c228d68a httpd-devel-2.2.3-11.el5.i386.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.x86_64.rpm 4603c4e041958a602c4bad393c90c6a7 httpd-manual-2.2.3-11.el5.x86_64.rpm 07e2c67b68e178bac107a3e61a929f23 mod_ssl-2.2.3-11.el5.x86_64.rpm fd20a69dc6b00651fae0d0d86511b867 Red Hat Enterprise Linux Desktop (v. 5 client) -------------------------------------------------------------------------------- SRPMS: httpd-2.2.3-11.el5.src.rpm 3ee6039a6aa2beeb14c55695c48cb6be IA-32: httpd-2.2.3-11.el5.i386.rpm d734aeef038abf88bf4886911c124c7a mod_ssl-2.2.3-11.el5.i386.rpm 86a4778fab59148114af83ba1eca224f x86_64: httpd-2.2.3-11.el5.x86_64.rpm 0030021cc1bc50b7c1d149f7c228d68a mod_ssl-2.2.3-11.el5.x86_64.rpm fd20a69dc6b00651fae0d0d86511b867 (The unlinked packages above are only available from the Red Hat Network) Bugs fixed (see bugzilla for more information) 240024 - Mod_proxy_http ProxyErrorOverride eating cookies 240857 - [RFE] Apache does not report patch level when scanned 241680 - logrotate.d/httpd postrotate must use initscripts 245719 - mod_proxy configuration inheritance issue 245763 - long lines incorrectly handled by Apache's logresolve 250731 - CVE-2007-3847 httpd out of bounds read References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 http://www.redhat.com/security/updates/classification/#moderate -------------------------------------------------------------------------------- These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: https://www.redhat.com/security/team/key/#package The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/ [***** End Red Hat RHSA-2007:0746-8 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) S-029: IBM Lotus Notes Vulnerabilities S-030: Adobe Security Update S-031: RSA Keon Vulnerability S-032: CUPS Security Update and Bug Fix Update S-033: AIX lqueryvg Buffer Overflow Vulnerability S-034: SonicWall NetExtender NELaunchCtrl ActiveX Vulnerability S-035: Perdition Format String Error S-036: Mono Vulnerability S-037: Perl-Compatible Regular Expression (PCRE) Vulnerabilities S-038: Perl Security Update