MGASA-2018-0007

Dashboard / Vulnerabilities / MGASA-2018-0007

MGASA-2018-0007

Summary: Updated apache packages fix security vulnerability

Details: mod_sessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC (CVE-2016-0736). Malicious input to mod_auth_digest will cause the server to crash, and each instance continues to crash even for subsequently valid requests (CVE-2016-2161). Emmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed (CVE-2017-3167). Vasileios Panopoulos of AdNovum Informatik AG discovered that mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port leading to a denial of service (CVE-2017-3169). Javier Jimenez reported that the HTTP strict parsing contains a flaw leading to a buffer overread in ap_find_token(). A remote attacker can take advantage of this flaw by carefully crafting a sequence of request headers to cause a segmentation fault, or to force ap_find_token() to return an incorrect value (CVE-2017-7668). ChenQin and Hanno Boeck reported that mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header (CVE-2017-7679). Robert Swiecki reported that mod_auth_digest does not properly initialize or reset the value placeholder in [Proxy-]Authorization headers of type "Digest" between successive key=value assignments, leading to information disclosure or denial of service (CVE-2017-9788). Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit directives in .htaccess files. In certain configurations, a remote attacker could possibly use this issue to read arbitrary server memory, including sensitive information. This issue is known as Optionsbleed (CVE-2017-9798).

References: https://advisories.mageia.org/MGASA-2018-0007.html, https://bugs.mageia.org/show_bug.cgi?id=20002, https://www.debian.org/security/2017/dsa-3896, https://www.debian.org/security/2017/dsa-3913, https://usn.ubuntu.com/usn/usn-3425-1/, https://httpd.apache.org/security/vulnerabilities_24.html