SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5760)

medium Nessus Plugin ID 58030

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

This update of apache2 and libapr1 fixes regressions and several security problems.

- Fixed a scoreboard corruption (shared mem segment) by child causes crash of privileged parent (invalid free()) during shutdown. (CVE-2012-0031)

- Fixed an issue in error responses that could expose 'httpOnly' cookies when no custom ErrorDocument is specified for status code 400'. (CVE-2012-0053)

- The 'mod_reqtimeout' module was backported from Apache 2.2.21 to help mitigate the 'Slowloris' Denial of Service attack. You need to enable the 'mod_reqtimeout' module in your existing apache configuration to make it effective, e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2. For more detailed information, check also the README file. (CVE-2007-6750)

Also the following bugs have been fixed :

- Fixed init script action 'check-reload' to avoid potential crashes. (bnc#728876)

- An overlapping memcpy() was replaced by memmove() to make this work with newer glibcs. (bnc#738067 / bnc#741874)

- libapr1: reset errno to zero to not return previous value despite good status of new operation. (bnc#739783)

Solution

Apply SAT patch number 5760.

Plugin Details

Severity: Medium

ID: 58030

File Name: suse_11_apache2-201202-120203.nasl

Version: 1.10

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 2/20/2012

Updated: 1/19/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:apache2, cpe:/o:novell:suse_linux:11, p-cpe:/a:novell:suse_linux:11:apache2-prefork, p-cpe:/a:novell:suse_linux:11:apache2-example-pages, p-cpe:/a:novell:suse_linux:11:libapr1, p-cpe:/a:novell:suse_linux:11:apache2-doc, p-cpe:/a:novell:suse_linux:11:apache2-worker, p-cpe:/a:novell:suse_linux:11:apache2-utils

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2/3/2012

Reference Information

CVE: CVE-2007-6750, CVE-2012-0031, CVE-2012-0053

Detections

Analytics