此更新包含 Apache HTTP Server 的最新穩定版本 httpd 2.4.10，可修正數個安全性問題。

http://www.apache.org/dist/httpd/Announcement2.4.html

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

远程 Solaris 系统缺少用于处理安全更新的必要修补程序：

- Apache HTTP Server 2.4.6 中，在启用了缓存转发代理时，mod_cache 模块中 modules/cache/cache_storage.c 内的 cache_invalidate 函数允许远程 HTTP 服务器通过触发缺失主机名值的矢量来造成拒绝服务（空指针取消引用和后台程序崩溃）。(CVE-2013-4352)

- 在启用了反向代理时，低于 2.4.10 的 Apache HTTP Server 2.4.x 中的 mod_proxy 模块允许远程攻击者通过构建的 HTTP 连接标头造成拒绝服务（子进程崩溃）。(CVE-2014-0117)

- 低于 2.4.10 的 Apache HTTP Server 中，在启用了请求正文解压缩时，mod_deflate 模块中 mod_deflate.c 内的 deflate_in_filter 函数允许远程攻击者通过构建的请求数据（其解压缩到大得多的大小）造成拒绝服务（资源消耗）。(CVE-2014-0118)

- 低于 2.4.10 的 Apache HTTP Server 中 mod_status 模块中的争用条件允许远程攻击者通过构建的请求造成拒绝服务（基于堆的缓冲区溢出），或者可能获得敏感的凭据信息或执行任意代码，该构建的请求在 modules/generators/mod_status.c 中的 status_handler 函数内和 modules/lua/lua_request.c 中的 lua_ap_scoreboard_worker 函数内触发错误的记分板处理。(CVE-2014-0226)

- 低于 2.4.10 的 Apache HTTP Server 中的 mod_cgid 模块不具有超时机制，这允许远程攻击者通过请求 CGI 脚本（不从其 stdin 文件描述符读取）造成拒绝服务（进程挂起）。(CVE-2014-0231)

为 Slackware 13.0、13.1、13.37、14.0、14.1 以及当前版本提供了用于修复安全问题的新 httpd 程序包。

更新后的 httpd 程序包修复了多种安全问题，现在可用于 Red Hat Enterprise Linux 7。

Red Hat 安全响应团队已将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

httpd 程序包提供 Apache HTTP Server（一款强大、高效、可扩展的 Web 服务器）。

在 mod_status httpd 模块中发现导致基于堆的缓冲区溢出的争用条件缺陷。能够访问由 mod_status 在使用线程式多重处理模块 (MPM) 的服务器上提供的状态页面的远程攻击者可以发送特别构建的请求，从而导致 httpd 子进程崩溃或可能允许攻击者以“apache”用户的权限执行任意代码。(CVE-2014-0226)

在 mod_cache httpd 模块中发现空指针取消引用缺陷。将 Apache HTTP Server 用作具有缓存的正向代理时，恶意 HTTP 服务器可导致 httpd 子进程崩溃。(CVE-2013-4352)

在 mod_proxy httpd 模块中发现拒绝服务缺陷。远程攻击者可以向配置为使用线程式多重处理模块 (MPM) 的反向代理的服务器发送特别构建的请求，从而导致 httpd 子进程崩溃。
(CVE-2014-0117)

在 httpd 的 mod_deflate 模块处理请求正文解压缩（通过 DEFLATE 输入过滤器配置）的方式中发现拒绝服务缺陷。能够发送其正文可被解压缩的请求的远程攻击者可利用此缺陷消耗目标系统上过多的系统内存和 CPU。
(CVE-2014-0118)

已发现 httpd 的 mod_cgid 模块执行未从标准输入读取数据的 CGI 脚本的方式中存在拒绝服务缺陷。远程攻击者可提交特别构建的请求，以导致 httpd 子进程无限期挂起。(CVE-2014-0231)

建议所有 httpd 用户升级这些更新后的程序包，其中包含用于修正这些问题的向后移植的修补程序。安装更新后的程序包后，httpd 后台程序将自动重新启动。

此更新包括 Apache HTTP Server 的最新稳定版本 httpd 2.4.10，修复了多个安全问题。

http://www.apache.org/dist/httpd/Announcement2.4.html

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

Updated apache packages fix security vulnerabilities :

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when logging cookies (CVE-2014-0098).

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the apache user (CVE-2014-0226).

A denial of service flaw was found in the mod_proxy httpd module. A remote attacker could send a specially crafted request to a server configured as a reverse proxy using a threaded Multi-Processing Modules (MPM) that would cause the httpd child process to crash (CVE-2014-0117).

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the DEFLATE input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system (CVE-2014-0118).

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely (CVE-2014-0231).

A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled (CVE-2014-3581).

mod_lua.c in the mod_lua module in the Apache HTTP Server through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory (CVE-2014-8109).

In the mod_lua module in the Apache HTTP Server through 2.4.10, a maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash (CVE-2015-0228).

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers (CVE-2013-5704).

Note: With this update, httpd has been modified to not merge HTTP Trailer headers with other HTTP request headers. A newly introduced configuration directive MergeTrailers can be used to re-enable the old method of processing Trailer headers, which also re-introduces the aforementioned flaw.

This update also fixes the following bug :

Prior to this update, the mod_proxy_wstunnel module failed to set up an SSL connection when configured to use a back end server using the wss: URL scheme, causing proxied connections to fail. In these updated packages, SSL is used when proxying to wss: back end servers (rhbz#1141950).

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Apache HTTP SERVER PROJECT reports : mod_proxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of sevice via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0921 advisory.

    - mod_cgid: add security fix for CVE-2014-0231 (#1120607)
    - mod_proxy: add security fix for CVE-2014-0117 (#1120607)
    - mod_deflate: add security fix for CVE-2014-0118 (#1120607)
    - mod_status: add security fix for CVE-2014-0226 (#1120607)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2299-1 advisory.

    Marek Kroemeke discovered that the mod_proxy module incorrectly handled certain requests. A remote     attacker could use this issue to cause the server to stop responding, leading to a denial of service. This     issue only affected Ubuntu 14.04 LTS. (CVE-2014-0117)

    Giancarlo Pellegrino and Davide Balzarotti discovered that the mod_deflate module incorrectly handled body     decompression. A remote attacker could use this issue to cause resource consumption, leading to a denial     of service. (CVE-2014-0118)

    Marek Kroemeke and others discovered that the mod_status module incorrectly handled certain requests. A     remote attacker could use this issue to cause the server to stop responding, leading to a denial of     service, or possibly execute arbitrary code. (CVE-2014-0226)

    Rainer Jung discovered that the mod_cgid module incorrectly handled certain scripts. A remote attacker     could use this issue to cause the server to stop responding, leading to a denial of service.
    (CVE-2014-0231)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This apache2 update fixes the following security issues :

  - fix for crash in mod_proxy processing specially crafted     requests with reverse proxy configurations that results     in a crash and a DoS condition for the server.
    CVE-2014-0117

  - new config option CGIDScriptTimeout set to 60s in new     file conf.d/cgid-timeout.conf, preventing worker     processes hanging forever if a cgi launched from them     has stopped reading input from the server (DoS).
    CVE-2014-0231

  - Fix for a NULL pointer dereference in mod_cache that     causes a crash in caching forwarding configurations,     resulting in a DoS condition. CVE-2013-4352

  - fix for crash in parsing cookie content, resulting in a     DoS against the server CVE-2014-0098

  - fix for mod_status race condition in scoreboard handling     and consecutive heap overflow and information disclosure     if access to mod_status is granted to a potential     attacker. CVE-2014-0226

  - fix for improper handling of whitespace characters from     CDATA sections to mod_dav, leading to a crash and a DoS     condition of the apache server process CVE-2013-6438

Versions of Apache HTTP server 2.4.6, 2.4.7, and 2.4.9 are unpatched for the following vulnerability:

  - A crash in Connection header handling, which can lead to denial of service against a reverse proxy (CVE-2014-0117)

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Admin Framework
 - Apache
 - ATS
 - Certificate Trust Policy
 - CFNetwork HTTPProtocol
 - CFNetwork Session
 - CFURL
 - CoreAnimation
 - FontParser
 - Graphics Driver
 - Hypervisor
 - ImageIO
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libnetcore
 - ntp
 - Open Directory Client
 - OpenLDAP
 - OpenSSL
 - PHP
 - QuickLook
 - SceneKit
 - ScreenSharing
 - Security - Code SIgning
 - UniformTypeIdentifiers
 - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名稱	產品	系列	已發布	已更新	嚴重性
77207	Fedora 19 : httpd-2.4.10-1.fc19 (2014-9057)	Nessus	Fedora Local Security Checks	2014/8/15	2021/1/11	medium
80589	Oracle Solaris 第三方修补程序更新：apache (multiple_denial_of_service_dos5)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
76712	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 当前版本：httpd (SSA:2014-204-01)	Nessus	Slackware Local Security Checks	2014/7/24	2021/1/14	medium
76905	RHEL 7：httpd (RHSA-2014:0921)	Nessus	Red Hat Local Security Checks	2014/7/30	2021/1/14	medium
77207	Fedora 19：httpd-2.4.10-1.fc19 (2014-9057)	Nessus	Fedora Local Security Checks	2014/8/15	2021/1/11	medium
82346	Mandriva Linux Security Advisory : apache (MDVSA-2015:093)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical
76614	FreeBSD : apache24 -- several vulnerabilities (4364e1f1-0f44-11e4-b090-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	2014/7/21	2021/1/6	medium
76745	Oracle Linux 7 : httpd (ELSA-2014-0921)	Nessus	Oracle Linux Local Security Checks	2014/7/24	2024/10/22	high
76757	Ubuntu 14.04 LTS : Apache HTTP Server vulnerabilities (USN-2299-1)	Nessus	Ubuntu Local Security Checks	2014/7/24	2025/9/3	high
77292	openSUSE Security Update : apache2 (openSUSE-SU-2014:1044-1)	Nessus	SuSE Local Security Checks	2014/8/21	2021/1/19	medium
700213	Apache HTTP Server 2.4.6, 2.4.7, 2.4.9 Vulnerability	Nessus Network Monitor	Web Servers	2014/7/29	2018/9/16	medium
700510	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

critical

medium

high

high

medium

medium

critical