Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: Ubuntu Local Security Checks --> Category: infos

USN160-1 : apache2 vulnerabilities Vulnerability Scan

Vulnerability Scan Summary
apache2 vulnerabilities

Detailed Explanation for this Vulnerability Test

Synopsis :

These remote packages are missing security patches :
- apache2
- apache2-common
- apache2-doc
- apache2-mpm-perchild
- apache2-mpm-prefork
- apache2-mpm-threadpool
- apache2-mpm-worker
- apache2-prefork-dev
- apache2-threaded-dev
- apache2-utils
- libapr0
- libapr0-dev

Description :

Marc Stern discovered a buffer overflow in the SSL module's
certificate revocation list (CRL) handler. If Apache is configured to
use a malicious CRL, this could possibly lead to a server crash or
arbitrary code execution with the rights of the Apache web server.

Watchfire discovered that Apache insufficiently verified the
"Transfer-Encoding" and "Content-Length" headers when acting as an
HTTP proxy. By sending a specially crafted HTTP request, a remote
attacker who is authorized to use the proxy could exploit this to
bypass web application firewalls, poison the HTTP proxy cache, and
conduct cross-site scripting attacks against other proxy users.

Solution :

Upgrade to :
- apache2-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-common-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-doc-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-mpm-perchild-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-mpm-prefork-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-mpm-threadpool-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-mpm-worker-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-prefork-dev-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-threaded-dev-2.0.53-5ubuntu5.2 (Ubuntu 5.04)
- apache2-utils-2.0.53-5ubuntu5.

Threat Level: High

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.