Ubuntu 8.04 LTS / 8.10 / 9.04 : apr-util vulnerabilities (USN-786-1)

Ubuntu Security Notice (C) 2009-2016 Canonical, Inc. / NASL script (C) 2009-2016 Tenable Network Security, Inc.

Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

Matthew Palmer discovered an underflow flaw in apr-util. An attacker
could cause a denial of service via application crash in Apache using
a crafted SVNMasterURI directive, .htaccess file, or when using
mod_apreq2. Applications using libapreq2 are also affected.

It was discovered that the XML parser did not properly handle entity
expansion. A remote attacker could cause a denial of service via
memory resource consumption by sending a crafted request to an Apache
server configured to use mod_dav or mod_dav_svn. (CVE-2009-1955)

C. Michael Pilato discovered an off-by-one buffer overflow in apr-util
when formatting certain strings. For big-endian machines (powerpc,
hppa and sparc in Ubuntu), a remote attacker could cause a denial of
service or information disclosure leak. All other architectures for
Ubuntu are not considered to be at risk. (CVE-2009-1956).

Solution :

Update the affected libaprutil1, libaprutil1-dbg and / or
libaprutil1-dev packages.

Risk factor :

High / CVSS Base Score : 7.8
CVSS Temporal Score : 6.8
Public Exploit Available : false

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 39363 ()

Bugtraq ID: 35221

CVE ID: CVE-2009-0023