在 TLS 與 SSL 通訊協定中發現一個設計瑕疵，允許攻擊者在 TLS/SSL 連線開始時插入任意內容。攻擊與 TLS 和 SSL 處理工作階段重新交涉的方式有關。已為此弱點指派 CVE-2009-3555。

作為對此攻擊的部分減輕，此 apache2 更新會停用用戶端起始的重新交涉。這應修正大部分使用中 Apache 組態的弱點。

注意：這並非問題的完整修正。在伺服器起始重新交涉的組態中仍可能發生攻擊。對於下列組態而言便是如此 (更新版套件變更記錄中的資訊有些不正確)：

  -「SSLVerifyClient」指示詞用於目錄或位置內容中。
  - 「SSLCipherSuite」指示詞用於目錄或位置內容中。

作為因應措施，您可能會以 SSLVerifyClient 與 SSLCipherSuite 僅用於伺服器或虛擬主機層級的方式，重新配置組態。


問題的完整修正需要通訊協定變更。詳細資訊將包含在關於此問題的單獨公告中。

此外，此更新也可修正 Apache mod_proxy_ftp 中的下列問題：

  - CVE-2009-3094 mod_proxy_ftp 模組中的輸入驗證不充分，允許遠端 FTP 伺服器透過 EPSV 命令的格式錯誤回覆，造成拒絕服務 (NULL 指標解除參照與子處理程序損毀)。

  - CVE-2009-3095 mod_proxy_ftp 模組中的輸入驗證不充分，允許經驗證的遠端攻擊者繞過預定的存取限制，並將任意 FTP 命令傳送至 FTP 伺服器。

來自 Red Hat 安全性公告 2009:1579：

現已提供適用於 Red Hat Enterprise Linux 3 和 5 的更新版 httpd 套件，可修正多個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

Apache HTTP Server 是一款流行的 Web 伺服器。

在傳輸層安全性/安全通訊端層 (Transport Layer Security/Secure Sockets Layer, TLS/SSL) 通訊協定處理工作階段重新交涉的方式中發現一個瑕疵。
攔截式攻擊者可利用此瑕疵將任意純文字前置至用戶端工作階段 (例如，HTTPS 連線至網站)。如此可強制伺服器處理攻擊者的要求 (偽裝成受害者的認證身分完成驗證)。此更新透過拒絕用戶端要求的重新交涉，在一定程度上減輕了這個瑕疵帶來的影響 (針對使用 mod_ssl 之 HTTP 伺服器的 SSL 工作階段)。
(CVE-2009-3555)

注意：此更新未完全解決 HTTPS 伺服器的問題。
在需要伺服器起始重新交涉的組態中仍可能發生攻擊。如需詳細資訊，請參閱下列知識庫文章：
http://kbase.redhat.com/faq/docs/DOC-20491

在 Apache mod_proxy_ftp 模組中發現一個 NULL 指標解除參照瑕疵。向其代理要求的惡意 FTP 伺服器可利用此瑕疵，透過 EPSV 或 PASV 命令的格式錯誤回覆，使 httpd 子處理程序損毀，從而造成有限的拒絕服務。(CVE-2009-3094)

在 Apache mod_proxy_ftp 模組中發現第二個瑕疵。在反向代理伺服器組態中，遠端攻擊者可利用此瑕疵，透過建立特製的 HTTP 授權標頭，繞過預定的存取限制，從而允許攻擊者傳送任意命令至 FTP 伺服器。(CVE-2009-3095)

建議所有 httpd 使用者皆升級至這些更新版套件，其中包含可更正這些問題的反向移植修補程式。安裝更新版套件後，必須先重新啟動 httpd 程序，更新才會生效。

This update of the Apache webserver fixes various security issues :

  - the option IncludesNOEXEC could be bypassed via     .htaccess. (CVE-2009-1195)

  - mod_proxy could run into an infinite loop when used as     reverse proxy. (CVE-2009-1890)

  - mod_deflate continued to compress large files even after     a network connection was closed, causing mod_deflate to     consume large amounts of CPU. (CVE-2009-1891)

  - The ap_proxy_ftp_handler function in     modules/proxy/proxy_ftp.c in the mod_proxy_ftp module     allows remote FTP servers to cause a denial of service     (NULL pointer dereference and child process crash) via a     malformed reply to an EPSV command. (CVE-2009-3094)

  - access restriction bypass in mod_proxy_ftp module     (CVE-2009-3095)

This update of the Apache webserver fixes various security issues :

  - the option IncludesNOEXEC could be bypassed via     .htaccess (CVE-2009-1195) 

  - mod_proxy could run into an infinite loop when used as     reverse proxy (CVE-2009-1890) 

  - mod_deflate continued to compress large files even after     a network connection was closed, causing mod_deflate to     consume large amounts of CPU (CVE-2009-1891)

  - The ap_proxy_ftp_handler function in     modules/proxy/proxy_ftp.c in the mod_proxy_ftp module     allows remote FTP servers to cause a denial of service     (NULL pointer dereference and child process crash) via a     malformed reply to an EPSV command. (CVE-2009-3094)

  - access restriction bypass in mod_proxy_ftp module     (CVE-2009-3095)

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation.
A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials. This update partially mitigates this flaw for SSL sessions to HTTP servers using mod_ssl by rejecting client-requested renegotiation.
(CVE-2009-3555)

Note: This update does not fully resolve the issue for HTTPS servers.
An attack is still possible in configurations that require a server-initiated renegotiation. Refer to the following Knowledgebase article for further information:
http://kbase.redhat.com/faq/docs/DOC-20491

A NULL pointer dereference flaw was found in the Apache mod_proxy_ftp module. A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service. (CVE-2009-3094)

A second flaw was found in the Apache mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server. (CVE-2009-3095)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

This update contains the latest stable release of Apache httpd. Three security fixes are included, along with several minor bug fixes. A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation. A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials. This update partially mitigates this flaw for SSL sessions to HTTP servers using mod_ssl by rejecting client-requested renegotiation.
(CVE-2009-3555) Note: This update does not fully resolve the issue for HTTPS servers. An attack is still possible in configurations that require a server-initiated renegotiation A NULL pointer dereference flaw was found in the Apache mod_proxy_ftp module. A malicious FTP server to which requests are being proxied could use this flaw to crash an httpd child process via a malformed reply to the EPSV or PASV commands, resulting in a limited denial of service. (CVE-2009-3094) A second flaw was found in the Apache mod_proxy_ftp module. In a reverse proxy configuration, a remote attacker could use this flaw to bypass intended access restrictions by creating a carefully-crafted HTTP Authorization header, allowing the attacker to send arbitrary commands to the FTP server. (CVE-2009-3095) See the upstream changes file for further information: http://www.apache.org/dist/httpd/CHANGES_2.2.14

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.14.  Such versions are potentially affected by multiple vulnerabilities : 

  - Faulty error handling in the Solaris pollset support (Event Port backend) which could trigger hangs in the prefork and event MPMs on that platform (CVE-2009-2699)

  - The 'ap_proxy_ftp_handler' function in 'modules/proxy/proxy_ftp.c in the 'mod_proxy_ftp' module allows remote FTP servers to cause a denial-of-service via a malformed reply to an EPSV command. (CVE-2009-3094)

  - The 'mod_proxy_ftp' module allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server. (CVE-2009-3095)

NNM cannot determine whether the affected module is in use.

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.14.  Such versions are potentially affected by multiple vulnerabilities : 

  - Faulty error handling in the Solaris pollset support (Event Port backend) which could trigger hangs in the prefork and event MPMs on that platform (CVE-2009-2699)

  - The 'ap_proxy_ftp_handler' function in 'modules/proxy/proxy_ftp.c in the 'mod_proxy_ftp' module allows remote FTP servers to cause a denial-of-service via a malformed reply to an EPSV command. (CVE-2009-3094)

  - The 'mod_proxy_ftp' module allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server. (CVE-2009-3095)

ID	Name	Product	Family	Published	Updated	Severity
44799	Debian DSA-1934-1：apache2 - 多個問題	Nessus	Debian Local Security Checks	2/24/2010	1/4/2021	high
67958	Oracle Linux 3 / 5 : httpd (ELSA-2009-1579)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
42252	SuSE 11 Security Update : Apache 2 (SAT Patch Number 1417)	Nessus	SuSE Local Security Checks	10/26/2009	1/14/2021	high
42319	openSUSE 10 Security Update : apache2 (apache2-6576)	Nessus	SuSE Local Security Checks	10/30/2009	1/14/2021	high
42469	RHEL 3 / 5 : httpd (RHSA-2009:1579)	Nessus	Red Hat Local Security Checks	11/12/2009	1/14/2021	high
43329	Fedora 12 : httpd-2.2.14-1.fc12 (2009-12606)	Nessus	Fedora Local Security Checks	12/18/2009	1/11/2021	high
43090	Fedora 10 : httpd-2.2.14-1.fc10 (2009-12604)	Nessus	Fedora Local Security Checks	12/10/2009	1/11/2021	high
44120	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : httpd (SSA:2010-024-01)	Nessus	Slackware Local Security Checks	1/25/2010	1/14/2021	high
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	3/29/2010	5/28/2024	critical
5196	Apache < 2.2.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/6/2009	3/6/2019	medium
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	3/30/2010	3/6/2019	critical
800574	Apache < 2.2.14 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	10/6/2009		high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

high

high

critical

medium

critical

high