The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.

This update for apache2 fixes the following issues :

  - Allow disabling SNI on proxy connections using 'SetEnv     proxy-disable-sni 1' in the configuration files.
    (bsc#1052830)

  - Allow ECDH again in mod_ssl, it had been incorrectly     disabled with the 2.2.34 update. (bsc#1064561) Following     security issue has been fixed :

  - CVE-2017-9798: A use-after-free in the OPTIONS command     could be used by attackers to disclose memory of the     apache server process, when htaccess uses incorrect     Limit statement. (bsc#1058058) Additionally, references     to the following security issues, fixed by the previous     version-update of apache2 to Apache HTTPD 2.2.34 have     been added :

  - CVE-2017-7668: The HTTP strict parsing introduced a bug     in token list parsing, which allowed ap_find_token() to     search past the end of its input string. By maliciously     crafting a sequence of request headers, an attacker may     have be able to cause a segmentation fault, or to force     ap_find_token() to return an incorrect value.
    (bsc#1045061)

  - CVE-2017-3169: mod_ssl may have de-referenced a NULL     pointer when third-party modules call     ap_hook_process_connection() during an HTTP request to     an HTTPS port allowing for DoS. (bsc#1045062)

  - CVE-2017-3167: Use of the ap_get_basic_auth_pw() by     third-party modules outside of the authentication phase     may have lead to authentication requirements being     bypassed. (bsc#1045065)

  - CVE-2017-7679: mod_mime could have read one byte past     the end of a buffer when sending a malicious     Content-Type response header. (bsc#1045060)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.14. It is, therefore, potentially affected by multiple vulnerabilities :

  - Faulty error handling in the Solaris pollset support     could lead to a denial of service. (CVE-2009-2699)

  - The 'mod_proxy_ftp' module allows remote attackers to     bypass intended access restrictions. (CVE-2009-3095)

  - The 'ap_proxy_ftp_handler' function in     'modules/proxy/proxy_ftp.c' in the 'mod_proxy_ftp'     module allows remote FTP servers to cause a     denial of service. (CVE-2009-3094)

Note that the remote web server may not actually be affected by these vulnerabilities as Nessus did not try to determine whether the affected modules are in use or check for the issues themselves.

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.14.  Such versions are potentially affected by multiple vulnerabilities : 

  - Faulty error handling in the Solaris pollset support (Event Port backend) which could trigger hangs in the prefork and event MPMs on that platform (CVE-2009-2699)

  - The 'ap_proxy_ftp_handler' function in 'modules/proxy/proxy_ftp.c in the 'mod_proxy_ftp' module allows remote FTP servers to cause a denial-of-service via a malformed reply to an EPSV command. (CVE-2009-3094)

  - The 'mod_proxy_ftp' module allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server. (CVE-2009-3095)

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.14.  Such versions are potentially affected by multiple vulnerabilities : 

  - Faulty error handling in the Solaris pollset support (Event Port backend) which could trigger hangs in the prefork and event MPMs on that platform (CVE-2009-2699)

  - The 'ap_proxy_ftp_handler' function in 'modules/proxy/proxy_ftp.c in the 'mod_proxy_ftp' module allows remote FTP servers to cause a denial-of-service via a malformed reply to an EPSV command. (CVE-2009-3094)

  - The 'mod_proxy_ftp' module allows remote attackers to bypass intended access restrictions and send arbitrary commands to an FTP server. (CVE-2009-3095)

NNM cannot determine whether the affected module is in use.

ID	Name	Product	Family	Severity
104270	SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)	Nessus	SuSE Local Security Checks	critical
42052	Apache 2.2.x < 2.2.14 Multiple Vulnerabilities	Nessus	Web Servers	high
800574	Apache < 2.2.14 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
5196	Apache < 2.2.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2009-2699

high

Tenable Plugins

critical

high

high

medium