Amazon Linux AMI : httpd24 (ALAS-2015-579)

Medium Nessus Plugin ID 85452

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied. (CVE-2015-3185)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

A NULL pointer dereference flaw was found in the way httpd generated certain error responses. A remote attacker could possibly use this flaw crash the httpd child process using a request that triggers a certain HTTP error. (CVE-2015-0253)

A denial of service flaw was found in the way the mod_lua httpd module processed certain WebSocket Ping requests. A remote attacker could send a specially crafted WebSocket Ping packet that would cause the httpd child process to crash. (CVE-2015-0228)

Solution

Run 'yum update httpd24' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2015-579.html

Plugin Details

Severity: Medium

ID: 85452

File Name: ala_ALAS-2015-579.nasl

Version: 2.4

Type: local

Agent: unix

Published: 2015/08/18

Updated: 2018/04/18

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:httpd24, p-cpe:/a:amazon:linux:httpd24-debuginfo, p-cpe:/a:amazon:linux:httpd24-devel, p-cpe:/a:amazon:linux:httpd24-manual, p-cpe:/a:amazon:linux:httpd24-tools, p-cpe:/a:amazon:linux:mod24_ldap, p-cpe:/a:amazon:linux:mod24_proxy_html, p-cpe:/a:amazon:linux:mod24_session, p-cpe:/a:amazon:linux:mod24_ssl, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 2015/08/17

Reference Information

CVE: CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185

ALAS: 2015-579