RHSA-2009:1579: Moderate: httpd security update
First published: Wed Nov 11 2009(Updated: )
The Apache HTTP Server is a popular Web server.<br>A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure<br>Sockets Layer) protocols handle session renegotiation. A man-in-the-middle<br>attacker could use this flaw to prefix arbitrary plain text to a client's<br>session (for example, an HTTPS connection to a website). This could force<br>the server to process an attacker's request as if authenticated using the<br>victim's credentials. This update partially mitigates this flaw for SSL<br>sessions to HTTP servers using mod_ssl by rejecting client-requested<br>renegotiation. (CVE-2009-3555)<br>Note: This update does not fully resolve the issue for HTTPS servers. An<br>attack is still possible in configurations that require a server-initiated<br>renegotiation. Refer to the following Knowledgebase article for further<br>information: <a href="http://kbase.redhat.com/faq/docs/DOC-20491" target="_blank">http://kbase.redhat.com/faq/docs/DOC-20491</a> A NULL pointer dereference flaw was found in the Apache mod_proxy_ftp<br>module. A malicious FTP server to which requests are being proxied could<br>use this flaw to crash an httpd child process via a malformed reply to the<br>EPSV or PASV commands, resulting in a limited denial of service.<br>(CVE-2009-3094)<br>A second flaw was found in the Apache mod_proxy_ftp module. In a reverse<br>proxy configuration, a remote attacker could use this flaw to bypass<br>intended access restrictions by creating a carefully-crafted HTTP<br>Authorization header, allowing the attacker to send arbitrary commands to<br>the FTP server. (CVE-2009-3095)<br>All httpd users should upgrade to these updated packages, which contain<br>backported patches to correct these issues. After installing the updated<br>packages, the httpd daemon must be restarted for the update to take effect.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/httpd | <2.2.3-31.el5_4.2 | 2.2.3-31.el5_4.2 |
| redhat/httpd | <2.2.3-31.el5_4.2 | 2.2.3-31.el5_4.2 |
| redhat/httpd-devel | <2.2.3-31.el5_4.2 | 2.2.3-31.el5_4.2 |
| redhat/httpd-devel | <2.2.3-31.el5_4.2 | 2.2.3-31.el5_4.2 |
| redhat/httpd-manual | <2.2.3-31.el5_4.2 | 2.2.3-31.el5_4.2 |
| redhat/httpd-manual | <2.2.3-31.el5_4.2 | 2.2.3-31.el5_4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=521619
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=522209
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=533125
- http://www.redhat.com/security/updates/classification/#moderate
- http://kbase.redhat.com/faq/docs/DOC-20491
- https://access.redhat.com/errata/RHSA-2009:1579 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2009:1579?
The severity of RHSA-2009:1579 is considered critical due to the potential for man-in-the-middle attacks.
How do I fix RHSA-2009:1579?
To fix RHSA-2009:1579, upgrade to Apache HTTP Server version 2.2.3-31.el5_4.2 or later.
What type of attack does RHSA-2009:1579 expose my server to?
RHSA-2009:1579 exposes your server to man-in-the-middle attacks during TLS/SSL session renegotiation.
Which versions of Apache HTTP Server are affected by RHSA-2009:1579?
All versions of Apache HTTP Server prior to version 2.2.3-31.el5_4.2 are affected by RHSA-2009:1579.
Is RHSA-2009:1579 applicable to any other software besides Apache?
RHSA-2009:1579 specifically addresses vulnerabilities in the Apache HTTP Server and its related packages, such as httpd-devel and httpd-manual.
- agent/references
- agent/severity
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2009:1579
- agent/software-canonical-lookup
- agent/event
- agent/title
- agent/description
- agent/weakness
- agent/remedy
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat