ID

VAR-201507-0017

CVE

CVE-2015-3185

TITLE

Apache HTTP Server of server/request.c Inside ap_some_auth_required Vulnerabilities that prevent access restrictions in functions

DESCRIPTION

The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. Apache HTTP Server is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. The server is fast, reliable and extensible through a simple API. The vulnerability stems from the fact that when the program does not require authentication, the Require directive will still be used for authorization settings and in displayed in the configuration. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: httpd security update Advisory ID: RHSA-2015:1667-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1667.html Issue date: 2015-08-24 CVE Names: CVE-2015-3183 CVE-2015-3185 ===================================================================== 1. Summary: Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183) It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied. (CVE-2015-3185) All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1243887 - CVE-2015-3183 httpd: HTTP request smuggling attack against chunked request parser 1243888 - CVE-2015-3185 httpd: ap_some_auth_required() does not properly indicate authenticated request in 2.4 6. Package List: Red Hat Enterprise Linux Client Optional (v. 7): Source: httpd-2.4.6-31.el7_1.1.src.rpm noarch: httpd-manual-2.4.6-31.el7_1.1.noarch.rpm x86_64: httpd-2.4.6-31.el7_1.1.x86_64.rpm httpd-debuginfo-2.4.6-31.el7_1.1.x86_64.rpm httpd-devel-2.4.6-31.el7_1.1.x86_64.rpm httpd-tools-2.4.6-31.el7_1.1.x86_64.rpm mod_ldap-2.4.6-31.el7_1.1.x86_64.rpm mod_proxy_html-2.4.6-31.el7_1.1.x86_64.rpm mod_session-2.4.6-31.el7_1.1.x86_64.rpm mod_ssl-2.4.6-31.el7_1.1.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): Source: httpd-2.4.6-31.el7_1.1.src.rpm noarch: httpd-manual-2.4.6-31.el7_1.1.noarch.rpm x86_64: httpd-2.4.6-31.el7_1.1.x86_64.rpm httpd-debuginfo-2.4.6-31.el7_1.1.x86_64.rpm httpd-devel-2.4.6-31.el7_1.1.x86_64.rpm httpd-tools-2.4.6-31.el7_1.1.x86_64.rpm mod_ldap-2.4.6-31.el7_1.1.x86_64.rpm mod_proxy_html-2.4.6-31.el7_1.1.x86_64.rpm mod_session-2.4.6-31.el7_1.1.x86_64.rpm mod_ssl-2.4.6-31.el7_1.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: httpd-2.4.6-31.el7_1.1.src.rpm noarch: httpd-manual-2.4.6-31.el7_1.1.noarch.rpm ppc64: httpd-2.4.6-31.el7_1.1.ppc64.rpm httpd-debuginfo-2.4.6-31.el7_1.1.ppc64.rpm httpd-devel-2.4.6-31.el7_1.1.ppc64.rpm httpd-tools-2.4.6-31.el7_1.1.ppc64.rpm mod_ssl-2.4.6-31.el7_1.1.ppc64.rpm s390x: httpd-2.4.6-31.el7_1.1.s390x.rpm httpd-debuginfo-2.4.6-31.el7_1.1.s390x.rpm httpd-devel-2.4.6-31.el7_1.1.s390x.rpm httpd-tools-2.4.6-31.el7_1.1.s390x.rpm mod_ssl-2.4.6-31.el7_1.1.s390x.rpm x86_64: httpd-2.4.6-31.el7_1.1.x86_64.rpm httpd-debuginfo-2.4.6-31.el7_1.1.x86_64.rpm httpd-devel-2.4.6-31.el7_1.1.x86_64.rpm httpd-tools-2.4.6-31.el7_1.1.x86_64.rpm mod_ssl-2.4.6-31.el7_1.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: httpd-2.4.6-31.ael7b_1.1.src.rpm noarch: httpd-manual-2.4.6-31.ael7b_1.1.noarch.rpm ppc64le: httpd-2.4.6-31.ael7b_1.1.ppc64le.rpm httpd-debuginfo-2.4.6-31.ael7b_1.1.ppc64le.rpm httpd-devel-2.4.6-31.ael7b_1.1.ppc64le.rpm httpd-tools-2.4.6-31.ael7b_1.1.ppc64le.rpm mod_ssl-2.4.6-31.ael7b_1.1.ppc64le.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: httpd-debuginfo-2.4.6-31.el7_1.1.ppc64.rpm mod_ldap-2.4.6-31.el7_1.1.ppc64.rpm mod_proxy_html-2.4.6-31.el7_1.1.ppc64.rpm mod_session-2.4.6-31.el7_1.1.ppc64.rpm s390x: httpd-debuginfo-2.4.6-31.el7_1.1.s390x.rpm mod_ldap-2.4.6-31.el7_1.1.s390x.rpm mod_proxy_html-2.4.6-31.el7_1.1.s390x.rpm mod_session-2.4.6-31.el7_1.1.s390x.rpm x86_64: httpd-debuginfo-2.4.6-31.el7_1.1.x86_64.rpm mod_ldap-2.4.6-31.el7_1.1.x86_64.rpm mod_proxy_html-2.4.6-31.el7_1.1.x86_64.rpm mod_session-2.4.6-31.el7_1.1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64le: httpd-debuginfo-2.4.6-31.ael7b_1.1.ppc64le.rpm mod_ldap-2.4.6-31.ael7b_1.1.ppc64le.rpm mod_proxy_html-2.4.6-31.ael7b_1.1.ppc64le.rpm mod_session-2.4.6-31.ael7b_1.1.ppc64le.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: httpd-2.4.6-31.el7_1.1.src.rpm noarch: httpd-manual-2.4.6-31.el7_1.1.noarch.rpm x86_64: httpd-2.4.6-31.el7_1.1.x86_64.rpm httpd-debuginfo-2.4.6-31.el7_1.1.x86_64.rpm httpd-devel-2.4.6-31.el7_1.1.x86_64.rpm httpd-tools-2.4.6-31.el7_1.1.x86_64.rpm mod_ssl-2.4.6-31.el7_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: httpd-debuginfo-2.4.6-31.el7_1.1.x86_64.rpm mod_ldap-2.4.6-31.el7_1.1.x86_64.rpm mod_proxy_html-2.4.6-31.el7_1.1.x86_64.rpm mod_session-2.4.6-31.el7_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-3183 https://access.redhat.com/security/cve/CVE-2015-3185 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFV22bdXlSAg2UNWIIRAtlWAKCRoS+swsPU7SFVjoNK5nifbipGPACfbnGp vg4WkQFOi6OeD9X4Kiuo2gA= =LQPk -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-2686-1 July 27, 2015 apache2 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in the Apache HTTP server. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-3185) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: apache2.2-bin 2.4.10-9ubuntu1.1 Ubuntu 14.04 LTS: apache2.2-bin 2.4.7-1ubuntu4.5 Ubuntu 12.04 LTS: apache2.2-bin 2.2.22-1ubuntu1.10 In general, a standard system update will make all the necessary changes. CVE-ID CVE-2015-5911 : Zachary Jones of WhiteHat Security Threat Research Center OS X Server 5.0.3 may be obtained from the Mac App Store. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2 serves as an update for Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es): * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. (CVE-2015-3185) * A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. Upstream acknowledges Karthikeyan Bhargavan (Inria) and GaA<<tan Leurent (Inria) as the original reporters of CVE-2016-2183. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. JIRA issues fixed (https://issues.jboss.org/): JBCS-329 - Unable to load large CRL openssl problem JBCS-337 - Errata for httpd 2.4.23 SP2 RHEL 6 7. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-09-16-2 Xcode 7.0 Xcode 7.0 is now available and addresses the following: DevTools Available for: OS X Yosemite v10.10.4 or later Impact: An attacker may be able to bypass access restrictions Description: An API issue existed in the apache configuration. This issue was addressed by updating header files to use the latest version. CVE-ID CVE-2015-3185 : Branko Aibej of the Apache Software Foundation IDE Xcode Server Available for: OS X Yosemite 10.10 or later Impact: An attacker may be able to access restricted parts of the filesystem Description: A comparison issue existed in the node.js send module prior to version 0.8.4. This issue was addressed by upgrading to version 0.12.3. CVE-ID CVE-2014-6394 : Ilya Kantor IDE Xcode Server Available for: OS X Yosemite v10.10.4 or later Impact: Multiple vulnerabilties in OpenSSL Description: Multiple vulnerabilties existed in the node.js OpenSSL module prior to version 1.0.1j. These issues were addressed by updating openssl to version 1.0.1j. CVE-ID CVE-2014-3513 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 IDE Xcode Server Available for: OS X Yosemite v10.10.4 or later Impact: An attacker with a privileged network position may be able to inspect traffic to Xcode Server Description: Connections to Xcode Server may have been made without encryption. This issue was addressed through improved network connection logic. CVE-ID CVE-2015-5910 : an anonymous researcher IDE Xcode Server Available for: OS X Yosemite v10.10.4 or later Impact: Build notifications may be sent to unintended recipients Description: An access issue existed in the handling of repository email lists. This issue was addressed through improved validation. CVE-ID CVE-2015-5909 : Daniel Tomlinson of Rocket Apps, David Gatwood of Anchorfree subversion Available for: OS X Yosemite v10.10.4 or later Impact: Multiple vulnerabilities existed in svn versions prior to 1.7.19 Description: Multiple vulnerabilities existed in svn versions prior to 1.7.19. These issues were addressed by updating svn to version 1.7.20. CVE-ID CVE-2015-0248 CVE-2015-0251 Xcode 7.0 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "7.0". A malicious client could force the server to misinterpret the request length, allowing cache poisoning or credential hijacking if an intermediary proxy is in use. CVE-2015-3185 A design error in the "ap_some_auth_required" function renders the API unusuable in apache2 2.4.x. The fix backports the new "ap_some_authn_required" API from 2.4.16. This issue does not affect the oldstable distribution (wheezy). In addition, the updated package for the oldstable distribution (wheezy) removes a limitation of the Diffie-Hellman (DH) parameters to 1024 bits. This limitation may potentially allow an attacker with very large computing resources, like a nation-state, to break DH key exchange by precomputation. The updated apache2 package also allows to configure custom DH parameters. More information is contained in the changelog.Debian.gz file. These improvements were already present in the stable, testing, and unstable distributions. For the oldstable distribution (wheezy), these problems have been fixed in version 2.2.22-13+deb7u5. For the stable distribution (jessie), these problems have been fixed in version 2.4.10-10+deb8u1. For the testing distribution (stretch), these problems will be fixed soon. For the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your apache2 packages

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

permissions and access control issues

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Ben Reser

SOURCES

LAST UPDATE DATE

2025-06-26T20:07:31.926000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE