O-015: Apache HTTP Server 2.0.48 Release Fixes Security Vulnerabilities Privacy and Legal Notice

CIAC INFORMATION BULLETIN

O-015: Apache HTTP Server 2.0.48 Release Fixes Security Vulnerabilities

[Apache 2.0.48 Released]

 October 29, 2003 19:00 GMT
[REVISED 21 Nov 2003]
[REVISED 10 Dec 2003]
[REVISED 17 Dec 2003]
[REVISED 18 Dec 2003]
[REVISED 14 Jan 2004]
[REVISED 11 Feb 2004]
[REVISED 21 Sep 2004]
[REVISED 12 Oct 2004]
[REVISED 15 Aug 2005]
PROBLEM: There exist two security vulnerabilities:
1) mod_cgid mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded Multi-processing Module (MPM) is used.
2) A buffer overflow could occur in mod_alias and mod_rewrite when a regular expression with more than 9 captures is configured.
SOFTWARE: Apache 2.0.47
PLATFORM: HP-UX B.11.00, B.11.11, B.11.20, B.11.23
Red Hat Enterprise Linux - AS, ES, and WS v2.1 and v.3
Red Hat Linux 7.1, 7.2, 7.3, 8.0 and 9
SGI
Sun Solaris 8 and 9
DAMAGE: 1) Information for one user could be directed to another.
2) A buffer overflow could cause a system crash or be used to take control of a system.
SOLUTION: Upgrade to appropriate version or apply appropriate patches.
VULNERABILITY
ASSESSMENT:		 The risk is LOW. The first problem is unlikely to expose a system to additional compromise. For the second problem, a mod_rewrite regular expression is unlikely to be configured to have more than 9 captures.
LINKS:  
  CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/o-015.shtml
  ORIGINAL BULLETIN: http://www.apache.org/dist/httpd/Announcement2.html
  ADDITIONAL INFORMATION: Visit Hewlett Packard's Subscription Service for:
HPSBUX0311-301 (SSRT3663)
   RED HAT Security Advisory RHSA-2003:360-08
https://rhn.redhat.com/errata/RHSA-2003-360.html
   RED HAT Security Advisory RHSA-2003:320-09
https://rhn.redhat.com/errata/RHSA-2003-320.html
   RED HAT Security Advisory RHSA-2003:405-04
https://rhn.redhat.com/errata/RHSA-2003-405.html
   RED HAT Security Advisory RHSA-2004:015-04
https://rhn.redhat.com/errata/RHSA-2004-015.html
   SGI security update #7
ftp://patches.sgi.com/support/free/security/advisories/20031203-01-U.asc
   Sun Alert ID: 57496 (superceded by Alert ID: 101444)
http://www.sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-101444-1
  CVE/CAN: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=
CVE-2003-0789 CVE-2003-0542 
REVISION HISTORY:
11/21/03 - Added Hewlett Packard's bulletin link information for HPSBUX0311-301
           (SSRT3663), added HP-UX in the Platform section.
12/10/03 - Added Red Hat's advisory link information for RHSA-2003:360-08 for
           their Enterprise Linux products, and added product versions in the
           the Platform section.
12/17/03 - Added Red Hat's advisory link information for RHSA-2003:320-09 for
           Linux 8.0 and 9 platforms, and added to the Platform section.
12/18/03 - (1) added a link to Red Hat's Security Advisory RHSA-2003:405-04 
           announcing the release of their updated Apache httpd packages for 
           their Linux platforms 7.1, 7.2 and 7.3.
           (2) added a link to SGI's Security Update #7 announcing the release
           of their Patch 10039 for this vulnerability.
1/14/04 -  add a link to Red Hat's Security Advisory RHSA-2004:015-04 announcing 
           the release of their updated Apache httpd packages for their Enterprise 
           Linux platforms AS, ES, WS (v. 3).
2/11/04 -  add a link to Sun Alert ID: 57496.
9/21/04 -  Sun Alert ID #57496 was updated by the release of T-patches for 
           Solaris 8.
10/12/04 - Sun Alert ID #57496 was updated.  The Contributing Factors and Resolution
           sections were modified.
08/15/05 - Sun Microsystems has superceded their Alert ID #57496 with Alert ID: 101444 
           and modified Contributing Factors and Resolutions sections where links to 
           patches are provided.
		   
[***** Start Apache 2.0.48 Released *****]

Apache HTTP Server 2.0.48 Released

The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the eleventh 
public release of the Apache 2.0 HTTP Server. This Announcement notes the significant changes in 2.0.48 
as compared to 2.0.47.

This version of Apache is principally a bug fix release. A summary of the bug fixes is given at the end 
of this document. Of particular note is that 2.0.48 addresses two security vulnerabilities:

mod_cgid mishandling of CGI redirect paths could result in CGI output going to the wrong client when a 
threaded MPM is used.
[CAN-2003-0789]

A buffer overflow could occur in mod_alias and mod_rewrite when a regular expression with more than 9 
captures is configured.
[CAN-2003-0542]

This release is compatible with modules compiled for 2.0.42 and later versions. We consider this release 
to be the best version of Apache available and encourage users of all prior versions to upgrade.

Apache 2.0.48 is available for download from

http://httpd.apache.org/download.cgi 

Please see the CHANGES_2.0 file, linked from the above page, for a full list of changes.

Apache 2.0 offers numerous enhancements, improvements, and performance boosts over the 1.3 codebase. For 
an overview of new features introduced after 1.3 please see

http://httpd.apache.org/docs-2.0/new_features_2_0.html

When upgrading or installing this version of Apache, please keep in mind the following:

If you intend to use Apache with one of the threaded MPMs, you must ensure that the modules (and the 
libraries they depend on) that you will be using are thread-safe. Please contact the vendors of these 
modules to obtain this information.

Apache 2.0.48 Major changes

Security vulnerabilities closed since Apache 2.0.47

Bugs fixed and features added since Apache 2.0.47


[***** End Apache 2.0.48 Released *****]
CIAC wishes to acknowledge the contributions of Apache for the information contained in this bulletin.
DOE-CIRC can be contacted at: 
    Voice:          +1 866-941-2472 (7 x 24)
    E-mail:          doecirc@doecirc.energy.gov
    World Wide Web:  http://www.doecirc.energy.gov/