Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : apache2 vulnerabilities (USN-731-1)

Ubuntu Security Notice (C) 2009-2013 Canonical, Inc. / NASL script (C) 2009-2013 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

It was discovered that Apache did not sanitize the method specifier
header from an HTTP request when it is returned in an error message,
which could result in browsers becoming vulnerable to cross-site
scripting attacks when processing the output. With cross-site
scripting vulnerabilities, if a user were tricked into viewing server
output during a crafted server request, a remote attacker could
exploit this to modify the contents, or steal confidential data (such
as passwords), within the same domain. This issue only affected Ubuntu
6.06 LTS and 7.10. (CVE-2007-6203)

It was discovered that Apache was vulnerable to a cross-site request
forgery (CSRF) in the mod_proxy_balancer balancer manager. If an
Apache administrator were tricked into clicking a link on a specially
crafted web page, an attacker could trigger commands that could modify
the balancer manager configuration. This issue only affected Ubuntu
7.10 and 8.04 LTS. (CVE-2007-6420)

It was discovered that Apache had a memory leak when using mod_ssl
with compression. A remote attacker could exploit this to exhaust
server memory, leading to a denial of service. This issue only
affected Ubuntu 7.10. (CVE-2008-1678)

It was discovered that in certain conditions, Apache did not specify a
default character set when returning certain error messages containing
UTF-7 encoded data, which could result in browsers becoming vulnerable
to cross-site scripting attacks when processing the output. This issue
only affected Ubuntu 6.06 LTS and 7.10. (CVE-2008-2168)

It was discovered that when configured as a proxy server, Apache did
not limit the number of forwarded interim responses. A malicious
remote server could send a large number of interim responses and cause
a denial of service via memory exhaustion. (CVE-2008-2364)

It was discovered that mod_proxy_ftp did not sanitize wildcard
pathnames when they are returned in directory listings, which could
result in browsers becoming vulnerable to cross-site scripting attacks
when processing the output. (CVE-2008-2939).

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.1
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 36589 ()

Bugtraq ID: 26663
29653
30560
31692

CVE ID: CVE-2007-6203
CVE-2007-6420
CVE-2008-1678
CVE-2008-2168
CVE-2008-2364
CVE-2008-2939