The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.

This Apache2 LTSS roll-up update for SUSE Linux Enterprise 10 SP3 LTSS fixes the following security issues and bugs :

  - CVE-2012-4557: Denial of Service via special requests in     mod_proxy_ajp

  - CVE-2012-0883: improper LD_LIBRARY_PATH handling

  - CVE-2012-2687: filename escaping problem

  - CVE-2012-0031: Fixed a scoreboard corruption (shared mem     segment) by child causes crash of privileged parent     (invalid free()) during shutdown.

  - CVE-2012-0053: Fixed an issue in error responses that     could expose 'httpOnly' cookies when no custom     ErrorDocument is specified for status code 400'.

  - The SSL configuration template has been adjusted not to     suggested weak ciphers CVE-2007-6750: The     'mod_reqtimeout' module was backported from Apache     2.2.21 to help mitigate the 'Slowloris' Denial of     Service attack.

    You need to enable the 'mod_reqtimeout' module in your     existing apache configuration to make it effective, e.g.
    in the APACHE_MODULES line in /etc/sysconfig/apache2.

  - CVE-2011-3639, CVE-2011-3368, CVE-2011-4317: This update     also includes several fixes for a mod_proxy reverse     exposure via RewriteRule or ProxyPassMatch directives.

  - CVE-2011-1473: Fixed the SSL renegotiation DoS by     disabling renegotiation by default.

  - CVE-2011-3607: Integer overflow in ap_pregsub function     resulting in a heap-based buffer overflow could     potentially allow local attackers to gain privileges

Additionally, some non-security bugs have been fixed which are listed in the changelog file.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the fix for CVE-2011-3368 did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request, or by using a specially crafted URI. (CVE-2011-3639 , CVE-2011-4317)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

From Red Hat Security Advisory 2012:0323 :

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via RHSA-2011:1392) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request. (CVE-2011-3639)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

From Red Hat Security Advisory 2012:0128 :

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via RHSA-2011:1391) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request, or by using a specially crafted URI.
(CVE-2011-3639, CVE-2011-4317)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via a previous update) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request. (CVE-2011-3639)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released in a previous update) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request, or by using a specially crafted URI.
(CVE-2011-3639, CVE-2011-4317)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.0.  As such, it is reportedly affected by the following vulnerabilities :

 - An error exists in the 'generate-id' function in the    bundled libxslt library that can allow disclosure of    heap memory addresses. (CVE-2011-0195)

 - An unspecified input validation error exists and can    allow cross-site request forgery attacks. (CVE-2011-3846)

 - Unspecified errors can allow attackers to carry out    denial of service attacks via unspecified vectors.
   (CVE-2012-0135, CVE-2012-1993)

 - The bundled version of PHP contains multiple    vulnerabilities. (CVE-2010-3436, CVE-2010-4409,    CVE-2010-4645, CVE-2011-1148, CVE-2011-1153,    CVE-2011-1464, CVE-2011-1467, CVE-2011-1468,    CVE-2011-1470, CVE-2011-1471, CVE-2011-1938,    CVE-2011-2202, CVE-2011-2483, CVE-2011-3182,    CVE-2011-3189, CVE-2011-3267, CVE-2011-3268)

 - The bundled version of Apache contains multiple    vulnerabilities. (CVE-2010-1452, CVE-2010-1623,    CVE-2010-2068,  CVE-2010-2791, CVE-2011-0419,    CVE-2011-1928, CVE-2011-3192, CVE-2011-3348,    CVE-2011-3368, CVE-2011-3639)

 - OpenSSL libraries are contained in several of the    bundled components and contain multiple vulnerabilities.
   (CVE-2011-0014, CVE-2011-1468, CVE-2011-1945,    CVE-2011-3207,CVE-2011-3210)

 - Curl libraries are contained in several of the bundled    components and contain multiple vulnerabilities.
   (CVE-2009-0037, CVE-2010-0734, CVE-2011-2192)

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via RHSA-2011:1392) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request. (CVE-2011-3639)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via RHSA-2011:1391) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request, or by using a specially crafted URI.
(CVE-2011-3639, CVE-2011-4317)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

The version of Apache HTTP Server running on the remote host has an information disclosure vulnerability.  When configured as a reverse proxy, improper use of the RewriteRule and ProxyPassMatch directives could cause the web server to proxy requests to arbitrary hosts.  This could allow a remote attacker to indirectly send requests to intranet servers by making specially crafted HTTP 0.9 requests.

This vulnerability only affects versions 2.2.x before 2.2.18 that have backported the fix for CVE-2011-3368.

Several vulnerabilities have been found in the Apache HTTPD Server :

  - CVE-2011-3607 :
    An integer overflow in ap_pregsub() could allow local     attackers to execute arbitrary code at elevated     privileges via crafted .htaccess files.

  - CVE-2011-3368 CVE-2011-3639 CVE-2011-4317 :
    The Apache HTTP Server did not properly validate the     request URI for proxied requests. In certain reverse     proxy configurations using the ProxyPassMatch directive     or using the RewriteRule directive with the [P] flag, a     remote attacker could make the proxy connect to an     arbitrary server. This could allow the attacker to     access internal servers that are not otherwise     accessible from the outside.

  The three CVE ids denote slightly different variants of the same   issue.

  Note that, even with this issue fixed, it is the responsibility of   the administrator to ensure that the regular expression replacement   pattern for the target URI does not allow a client to append   arbitrary strings to the host or port parts of the target URI. For   example, the configuration

  ProxyPassMatch ^/mail(.*) http://internal-host$1

  is still insecure and should be replaced by one of the following   configurations :

  ProxyPassMatch ^/mail(/.*) http://internal-host$1 ProxyPassMatch   ^/mail/(.*) http://internal-host/$1

  - CVE-2012-0031 :
    An apache2 child process could cause the parent process     to crash during shutdown. This is a violation of the     privilege separation between the apache2 processes and     could potentially be used to worsen the impact of other     vulnerabilities.

  - CVE-2012-0053 :
    The response message for error code 400 (bad request)     could be used to expose 'httpOnly' cookies. This could     allow a remote attacker using cross site scripting to     steal authentication cookies.

This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

Also a non-security bug was fixed :

  - httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make     non-ascii eg UTF8 passwords work with mod_authnz_ldap.
    [bnc#727071]

ID	Name	Product	Family	Severity
83578	SUSE SLES10 Security Update : apache2 (SUSE-SU-2013:0469-1)	Nessus	SuSE Local Security Checks	medium
69653	Amazon Linux AMI : httpd (ALAS-2012-46)	Nessus	Amazon Linux Local Security Checks	medium
68488	Oracle Linux 5 : httpd (ELSA-2012-0323)	Nessus	Oracle Linux Local Security Checks	medium
68458	Oracle Linux 6 : httpd (ELSA-2012-0128)	Nessus	Oracle Linux Local Security Checks	medium
61261	Scientific Linux Security Update : httpd on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	medium
61245	Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20120213)	Nessus	Scientific Linux Local Security Checks	medium
58811	HP System Management Homepage < 7.0 Multiple Vulnerabilities	Nessus	Web Servers	critical
58085	RHEL 5 : httpd (RHSA-2012:0323)	Nessus	Red Hat Local Security Checks	medium
57960	CentOS 6 : httpd (CESA-2012:0128)	Nessus	CentOS Local Security Checks	medium
57931	RHEL 6 : httpd (RHSA-2012:0128)	Nessus	Red Hat Local Security Checks	medium
57875	Apache HTTP Server mod_proxy Reverse Proxy HTTP 0.9 Information Disclosure	Nessus	Web Servers	medium
57851	Debian DSA-2405-1 : apache2 - multiple issues	Nessus	Debian Local Security Checks	medium
57298	SuSE 10 Security Update : Apache2 (ZYPP Patch Number 7882)	Nessus	SuSE Local Security Checks	medium
57090	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5482)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2011-3639

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium