Apr-util, the Apache Portable Runtime Utility library, is used by Apache 2.x, Subversion, and other applications. Two denial of service vulnerabilities have been found in apr-util :

  - 'kcope' discovered a flaw in the handling of internal     XML entities in the apr_xml_* interface that can be     exploited to use all available memory. This denial of     service can be triggered remotely in the Apache mod_dav     and mod_dav_svn modules. (No CVE id yet)
  - CVE-2009-0023     Matthew Palmer discovered an underflow flaw in the     apr_strmatch_precompile function that can be exploited     to cause a daemon crash. The vulnerability can be     triggered (1) remotely in mod_dav_svn for Apache if the     'SVNMasterURI' directive is in use, (2) remotely in     mod_apreq2 for Apache or other applications using     libapreq2, or (3) locally in Apache by a crafted     '.htaccess' file.

Other exploit paths in other applications using apr-util may exist.

If you use Apache, or if you use svnserve in standalone mode, you need to restart the services after you upgraded the libaprutil1 package.

The oldstable distribution (etch), these problems have been fixed in version 1.2.7+dfsg-2+etch2.

Matthew Palmer discovered an underflow flaw in apr-util. An attacker could cause a denial of service via application crash in Apache using a crafted SVNMasterURI directive, .htaccess file, or when using mod_apreq2. Applications using libapreq2 are also affected.
(CVE-2009-0023)

It was discovered that the XML parser did not properly handle entity expansion. A remote attacker could cause a denial of service via memory resource consumption by sending a crafted request to an Apache server configured to use mod_dav or mod_dav_svn. (CVE-2009-1955)

C. Michael Pilato discovered an off-by-one buffer overflow in apr-util when formatting certain strings. For big-endian machines (powerpc, hppa and sparc in Ubuntu), a remote attacker could cause a denial of service or information disclosure leak. All other architectures for Ubuntu are not considered to be at risk. (CVE-2009-1956).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to upstream version 1.3.7, see:
http://svn.apache.org/repos/asf/apr /apr-util/tags/1.3.7/CHANGES Security fixes: - CVE-2009-0023 Fix underflow in apr_strmatch_precompile. - CVE-2009-1955 Fix a denial of service attack against the apr_xml_* interface using the 'billion laughs' entity expansion technique. - CVE-2009-1956 Fix off by one overflow in apr_brigade_vprintf. Note: CVE-2009-1956 is only an issue on big-endian architectures.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200907-03 (APR Utility Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the APR Utility     Library:
    Matthew Palmer reported a heap-based buffer     underflow while compiling search patterns in the     apr_strmatch_precompile() function in strmatch/apr_strmatch.c     (CVE-2009-0023).
    kcope reported that the expat XML parser in     xml/apr_xml.c does not limit the amount of XML entities expanded     recursively (CVE-2009-1955).
    C. Michael Pilato reported an     off-by-one error in the apr_brigade_vprintf() function in     buckets/apr_brigade.c (CVE-2009-1956).
  Impact :

    A remote attacker could exploit these vulnerabilities to cause a Denial     of Service (crash or memory exhaustion) via an Apache HTTP server     running mod_dav or mod_dav_svn, or using several configuration files.
    Additionally, a remote attacker could disclose sensitive information or     cause a Denial of Service by sending a specially crafted input. NOTE:
    Only big-endian architectures such as PPC and HPPA are affected by the     latter flaw.
  Workaround :

    There is no known workaround at this time.

This update of libapr-util1 fixes a memory consumption bug in the XML parser that can cause a remote denial-of-service vulnerability in applications using APR (WebDAV for example) (CVE-2009-1955).
Additionally a one byte buffer overflow in function apr_brigade_vprintf() (CVE-2009-1956) and buffer underflow in function apr_strmatch_precompile() (CVE-2009-0023) was fixed too. Depending on the application using this function it can lead to remote denial of service or information leakage.

An off-by-one overflow flaw was found in the way apr-util processed a variable list of arguments. An attacker could provide a specially crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive information or a denial of service (application crash). (CVE-2009-1956)

A denial of service flaw was found in the apr-util Extensible Markup Language (XML) parser. A remote attacker could create a specially crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine. (CVE-2009-1955)

A heap-based underwrite flaw was found in the way apr-util created compiled forms of particular search patterns. An attacker could formulate a specially crafted search keyword, that would overwrite arbitrary heap memory locations when processed by the pattern preparation engine. (CVE-2009-0023)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

ID	名稱	產品	系列	已發布	已更新	嚴重性
39333	Debian DSA-1812-1 : apr-util - denial of service	Nessus	Debian Local Security Checks	2009/6/8	2021/1/4	high
39363	Ubuntu 8.04 LTS / 8.10 / 9.04 : apr-util vulnerabilities (USN-786-1)	Nessus	Ubuntu Local Security Checks	2009/6/11	2021/1/19	high
39503	Fedora 10 : apr-util-1.3.7-1.fc10 (2009-5969)	Nessus	Fedora Local Security Checks	2009/6/25	2021/1/11	high
39614	GLSA-200907-03 : APR Utility Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/7/6	2021/1/6	high
41418	SuSE 11 Security Update : libapr-util1 (SAT Patch Number 969)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
42010	openSUSE 10 Security Update : libapr-util1 (libapr-util1-6288)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	high
60598	Scientific Linux Security Update : httpd on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high