RHSA-2011:1392: Moderate: httpd security and bug fix update
The Apache HTTP Server is a popular web server.It was discovered that the Apache HTTP Server did not properly validate therequest URI for proxied requests. In certain configurations, if a reverseproxy used the ProxyPassMatch directive, or if it used the RewriteRuledirective with the proxy flag, a remote attacker could make the proxyconnect to an arbitrary server, possibly disclosing sensitive informationfrom internal web servers not directly accessible to the attacker.(CVE-2011-3368)Red Hat would like to thank Context Information Security for reporting thisissue.This update also fixes the following bug: The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update introduced regressions in the way httpd handled certain Range HTTP headervalues. This update corrects those regressions. (BZ#736593, BZ#736594)All httpd users should upgrade to these updated packages, which containbackported patches to correct these issues. After installing the updatedpackages, the httpd daemon must be restarted for the update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:1392?
The severity of RHSA-2011:1392 is considered important due to the potential for unauthorized access through improper request URI validation.
How do I fix RHSA-2011:1392?
To fix RHSA-2011:1392, you need to update the Apache HTTP Server to version 2.2.3-53.el5_7.3 or later.
What versions of Apache HTTP Server are affected by RHSA-2011:1392?
RHSA-2011:1392 affects Apache HTTP Server versions prior to 2.2.3-53.el5_7.3.
What is the nature of the vulnerability in RHSA-2011:1392?
The vulnerability in RHSA-2011:1392 arises from the Apache HTTP Server's failure to properly validate the request URI for proxied requests.
Which packages are impacted by the RHSA-2011:1392 vulnerability?
The impacted packages for RHSA-2011:1392 include httpd, httpd-devel, and httpd-manual on Red Hat Enterprise Linux.