Ubuntu Security Notice (C) 2009-2013 Canonical, Inc. / NASL script (C) 2009-2013 Tenable Network Security, Inc.
The remote Ubuntu host is missing one or more security-related patches.
Matthew Palmer discovered an underflow flaw in apr-util as included in
Apache. An attacker could cause a denial of service via application
crash in Apache using a crafted SVNMasterURI directive, .htaccess
file, or when using mod_apreq2. This issue only affected Ubuntu 6.06
Sander de Boer discovered that mod_proxy_ajp would reuse connections
when a client closed a connection without sending a request body. A
remote attacker could exploit this to obtain sensitive response data.
This issue only affected Ubuntu 9.04. (CVE-2009-1191)
Jonathan Peatfield discovered that Apache did not process Includes
options correctly. With certain configurations of Options and
AllowOverride, a local attacker could use an .htaccess file to
override intended restrictions and execute arbitrary code via a
Server-Side-Include file. This issue affected Ubuntu 8.04 LTS, 8.10
and 9.04. (CVE-2009-1195)
It was discovered that the XML parser did not properly handle entity
expansion. A remote attacker could cause a denial of service via
memory resource consumption by sending a crafted request to an Apache
server configured to use mod_dav or mod_dav_svn. This issue only
affected Ubuntu 6.06 LTS. (CVE-2009-1955)
C. Michael Pilato discovered an off-by-one buffer overflow in apr-util
when formatting certain strings. For big-endian machines (powerpc,
hppa and sparc in Ubuntu), a remote attacker could cause a denial of
service or information disclosure leak. All other architectures for
Ubuntu are not considered to be at risk. This issue only affected
Ubuntu 6.06 LTS. (CVE-2009-1956).
Update the affected packages.
Risk factor :
High / CVSS Base Score : 7.8
CVSS Temporal Score : 5.8
Public Exploit Available : false