ID

VAR-201105-0121

CVE

CVE-2011-0419

TITLE

Apache Portable Runtime Used in products such as libraries apr_fnmatch.c and fnmatch.c Service disruption in (CPU And memory consumption ) Vulnerabilities

DESCRIPTION

Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. Apache APR is prone to a vulnerability that may allow attackers to cause a denial-of-service condition. Apache APR versions prior to 1.4.4 are vulnerable. It mainly provides an underlying support interface library for upper-level applications that can be used across multiple operating system platforms. NetBSD is a free and open source Unix-like operating system developed by the NetBSD Foundation. Content-Type: multipart/alternative; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201405-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Apache Portable Runtime, APR Utility Library: Denial of Service Date: May 18, 2014 Bugs: #339527, #366903, #368651, #399089 ID: 201405-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Memory consumption errors in Apache Portable Runtime and APR Utility Library could result in Denial of Service. Background ========== The Apache Portable Runtime (aka APR) provides a set of APIs for creating platform-independent applications. The Apache Portable Runtime Utility Library (aka APR-Util) provides an interface to functionality such as XML parsing, string matching and database connections. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/apr < 1.4.8-r1 >= 1.4.8-r1 2 dev-libs/apr-util < 1.3.10 >= 1.3.10 ------------------------------------------------------------------- 2 affected packages Description =========== Multiple vulnerabilities have been discovered in Apache Portable Runtime and APR Utility Library. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Apache Portable Runtime users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/apr-1.4.8-r1" All users of the APR Utility Library should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/apr-util-1.3.10" Packages which depend on these libraries may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages. References ========== [ 1 ] CVE-2010-1623 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1623 [ 2 ] CVE-2011-0419 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0419 [ 3 ] CVE-2011-1928 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1928 [ 4 ] CVE-2012-0840 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0840 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201405-24.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . HP System Management Homepage (SMH) before v7.0 running on Linux and Windows. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02997184 Version: 4 HPSBUX02702 SSRT100606 rev.4 - HP-UX Apache Web Server, Remote Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2011-09-08 Last Updated: 2011-09-23 ----------------------------------------------------------------------------- Potential Security Impact: Remote Denial of Service (DoS) Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Apache Web Server. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS). References: CVE-2011-3192, CVE-2011-0419 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.17 containing Apache v2.2.15.07 or earlier HP-UX B.11.11 running HP-UX Apache Web Server Suite v2.33 containing Apache v2.0.64.01 or earlier BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2011-3192 (AV:N/AC:L/Au:N/C:N/I:N/A:C) 7.8 CVE-2011-0419 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION This bulletin will be revised when additional information becomes available. HP has provided the following software updates to resolve these vulnerabilities. HP-UX Web Server Suite (WSS) v3.18 containing Apache v2.2.15.08 The WSS v3.18 update is available for download from the following location https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXWSATW318 HP-UX 11i Releases / Apache Depot name B.11.23 & B.11.31 (32-bit) / HPUXWS22ATW-B318-32.depot B.11.23 & B.11.31 (64-bit) / HPUXWS22ATW-B318-64.depot HP-UX Web Server Suite (WSS) v2.33 containing Apache v2.0.64.01 and earlier The WSS v2.33 preliminary update is available for download from the following location ftp://srt10606:P2xg=AD5@ftp.usa.hp.com or https://ftp.usa.hp.com/hprc/home with username srt10606 and password P2xg=AD5 NOTE: CVE-2011-0419 is not resolved in the WSS v2.33 depot below. HP-UX 11i Release / Apache Depot name B.11.11 / Apache-2.0-CVE-2011-3192-Fix-11.11.depot B.11.23 (32 & 64-bit) / No longer supported. Upgrade to WSS v 3.18 B.11.31 (32 & 64-bit) / No longer supported. Upgrade to WSS v 3.18 Alternatives to Installing the WSS v2.33 Preliminary Patch The Apache Software Foundation has documented a work around. For customers not wanting to install the WSS v2.33 preliminary patch, the following are recommended. 1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request. 2) Limit the size of the request field to a few hundred bytes. 3) Use mod_headers to completely disallow the use of Range headers. Please refer to the Apache advisory for details. http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3c20110826103531.998348F82@minotaur.apache.org%3e MANUAL ACTIONS: Yes - Update For B.11.23 and B.11.31 install HP-UX Web Server Suite v3.18 or subsequent. For B.11.11 install HP-UX Web Server Suite v2.33 or subsequent. PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX Web Server Suite v3.18 HP-UX B.11.23 HP-UX B.11.31 ================== hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 hpuxws22APACHE.APACHE hpuxws22APACHE.APACHE2 hpuxws22APACHE.AUTH_LDAP hpuxws22APACHE.AUTH_LDAP2 hpuxws22APACHE.MOD_JK hpuxws22APACHE.MOD_JK2 hpuxws22APACHE.MOD_PERL hpuxws22APACHE.MOD_PERL2 hpuxws22APACHE.PHP hpuxws22APACHE.PHP2 hpuxws22APACHE.WEBPROXY hpuxws22APACHE.WEBPROXY2 action: install revision B.2.2.15.08 or subsequent HP-UX Web Server Suite v2.33 HP-UX B.11.11 ================== hpuxwsAPACHE.APACHE hpuxwsAPACHE.APACHE2 hpuxwsAPACHE.AUTH_LDAP hpuxwsAPACHE.AUTH_LDAP2 hpuxwsAPACHE.MOD_JK hpuxwsAPACHE.MOD_JK2 hpuxwsAPACHE.MOD_PERL hpuxwsAPACHE.MOD_PERL2 hpuxwsAPACHE.PHP hpuxwsAPACHE.PHP2 hpuxwsAPACHE.WEBPROXY action: install revision B.2.0.64.01 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 8 September 2011 Initial release Version:2 (rev.2) - 8 September 2011 Updated affectivity, recommendations, typos Version:3 (rev.3) - 22 September 2011 New source for depots Version:4 (rev.4) - 23 September 2011 Apache WSS 2.33 depot for B.11.11 available Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For further information, contact normal HP Services support channel. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02964430 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2011 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAk6BAtkACgkQ4B86/C0qfVkSawCgo1Kh0PqJsgb9du7mlIChfMAb l84AniniivdPKtMblybUY1mLV942e+1n =v0q9 -----END PGP SIGNATURE----- . An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for matching (such as an httpd server using the mod_autoindex module), to exhaust all stack memory or use an excessive amount of CPU time when performing matching (CVE-2011-0419). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=490 The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0419 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: be64584ff33e8b302b98371cc2250737 2009.0/i586/libapr1-1.3.3-2.2mdv2009.0.i586.rpm f7dc54c6193e0ca7f3a24606e9d7a418 2009.0/i586/libapr-devel-1.3.3-2.2mdv2009.0.i586.rpm 1b7160e3c2178a302c07a6e23d59c82d 2009.0/SRPMS/apr-1.3.3-2.2mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 8d7329923bb5e81dbca4ea1d355e2846 2009.0/x86_64/lib64apr1-1.3.3-2.2mdv2009.0.x86_64.rpm 7838341b9612ac1ab78606a8c2143306 2009.0/x86_64/lib64apr-devel-1.3.3-2.2mdv2009.0.x86_64.rpm 1b7160e3c2178a302c07a6e23d59c82d 2009.0/SRPMS/apr-1.3.3-2.2mdv2009.0.src.rpm Mandriva Linux 2010.0: 50d349a278f9fb9ddae7fe78b9c7cfb5 2010.0/i586/libapr1-1.3.9-1.1mdv2010.0.i586.rpm a2ab8bacb929689515885f8f6b55e20b 2010.0/i586/libapr-devel-1.3.9-1.1mdv2010.0.i586.rpm 09656854ddec250000ae8ec2a54db5ac 2010.0/SRPMS/apr-1.3.9-1.1mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: d1d1660e4427134fd94eb61c6bf50573 2010.0/x86_64/lib64apr1-1.3.9-1.1mdv2010.0.x86_64.rpm 0c26aa24bf82e860353f5d279f1d7c3d 2010.0/x86_64/lib64apr-devel-1.3.9-1.1mdv2010.0.x86_64.rpm 09656854ddec250000ae8ec2a54db5ac 2010.0/SRPMS/apr-1.3.9-1.1mdv2010.0.src.rpm Mandriva Linux 2010.1: 6bcbd128393e66f857a0237858b8296c 2010.1/i586/libapr1-1.4.2-1.1mdv2010.2.i586.rpm 711375d83f3e8ba475f5e50e9cd72c58 2010.1/i586/libapr-devel-1.4.2-1.1mdv2010.2.i586.rpm 1e79b3cbed82fe6a72a5e363ee6de1ac 2010.1/SRPMS/apr-1.4.2-1.1mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: 10e549216a50287a8b00ceabc989f582 2010.1/x86_64/lib64apr1-1.4.2-1.1mdv2010.2.x86_64.rpm dcb20d2f8c1698ad7da97d8cfad775bc 2010.1/x86_64/lib64apr-devel-1.4.2-1.1mdv2010.2.x86_64.rpm 1e79b3cbed82fe6a72a5e363ee6de1ac 2010.1/SRPMS/apr-1.4.2-1.1mdv2010.2.src.rpm Corporate 4.0: 14e8e64d57936ac0d07614bd67446f03 corporate/4.0/i586/libapr1-1.2.7-1.2.20060mlcs4.i586.rpm ce54af727421b84a6b44e1e93c026d2e corporate/4.0/i586/libapr1-devel-1.2.7-1.2.20060mlcs4.i586.rpm b32595e78258a491a42ca109d6bceba2 corporate/4.0/SRPMS/apr-1.2.7-1.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 8d384c32df7462ea43898d5747a8896e corporate/4.0/x86_64/lib64apr1-1.2.7-1.2.20060mlcs4.x86_64.rpm ceb813bb8fbcd8047c4bb8938bdef32b corporate/4.0/x86_64/lib64apr1-devel-1.2.7-1.2.20060mlcs4.x86_64.rpm b32595e78258a491a42ca109d6bceba2 corporate/4.0/SRPMS/apr-1.2.7-1.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 7e3ca3eb765d21b1366f55c9b9b56027 mes5/i586/libapr1-1.3.3-2.2mdvmes5.2.i586.rpm fbf9421168cb26090b5ff021a2bb823a mes5/i586/libapr-devel-1.3.3-2.2mdvmes5.2.i586.rpm f7afcb8a3dd0ecca2998a32df747afc9 mes5/SRPMS/apr-1.3.3-2.2mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 418475e740da85914275f648045dbacb mes5/x86_64/lib64apr1-1.3.3-2.2mdvmes5.2.x86_64.rpm bc4a3e5372735992d633f5933b540891 mes5/x86_64/lib64apr-devel-1.3.3-2.2mdvmes5.2.x86_64.rpm f7afcb8a3dd0ecca2998a32df747afc9 mes5/SRPMS/apr-1.3.3-2.2mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. Note: that no patch is available for Apache 2.0.64.01. If a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. For the oldstable distribution (lenny), this problem has been fixed in version 1.2.12-5+lenny3. For the stable distribution (squeeze), this problem has been fixed in version 1.4.2-6+squeeze1. For the testing distribution (wheezy), this problem will be fixed in version 1.4.4-1. For the unstable distribution (sid), this problem has been fixed in version 1.4.4-1. We recommend that you upgrade your apr packages and restart the apache2 server. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iD8DBQFNz5VHbxelr8HyTqQRAr+iAKCCa623GNuK3mENS4jcbZtGep2ohACeJa5s C1SL03ToxsHEiGJTzNWdiuU= =G1Is -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

AFFECTED PRODUCTS