RHSA-2010:0396: Moderate: httpd and httpd22 security and enhancement update

First published: Wed May 05 2010(Updated: )

The Apache HTTP Server is a popular web server.<br>It was discovered that mod_proxy_ajp incorrectly returned an "Internal<br>Server Error" response when processing certain malformed requests, which<br>caused the back-end server to be marked as failed in configurations where<br>mod_proxy is used in load balancer mode. A remote attacker could cause<br>mod_proxy to not send requests to back-end AJP (Apache JServ Protocol)<br>servers for the retry timeout period (60 seconds by default) by sending<br>specially-crafted requests. (CVE-2010-0408)<br>A use-after-free flaw was discovered in the way the Apache HTTP Server<br>handled request headers in subrequests. In configurations where subrequests<br>are used, a multithreaded MPM (Multi-Processing Module) could possibly leak<br>information from other requests in request replies. (CVE-2010-0434)<br>This update also adds the following enhancement:<br><li> with the updated openssl packages from RHSA-2010:0162 or RHSA-2010:0163</li> installed, mod_ssl will refuse to renegotiate a TLS/SSL connection with an<br>unpatched client that does not support RFC 5746. This update adds the<br>"SSLInsecureRenegotiation" configuration directive. If this directive is<br>enabled, mod_ssl will renegotiate insecurely with unpatched clients.<br>Refer to the following Red Hat Knowledgebase article for more details about<br>the changed mod_ssl behavior: <a href="http://kbase.redhat.com/faq/docs/DOC-20491" target="_blank">http://kbase.redhat.com/faq/docs/DOC-20491</a> All users of JBoss Enterprise Web Server 1.0.1 should upgrade to these<br>updated packages, which contain backported patches to correct these issues<br>and add this enhancement. After installing the updated packages, Red Hat<br>Enterprise Linux 4 users must restart the httpd22 service, and Red Hat<br>Enterprise Linux 5 users must restart the httpd service, for the update to<br>take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2010:0396
• agent/software-canonical-lookup
• package-manager/redhat