httpd-2.2.15-31.0.1.AXS4
エラータID: AXSA:2014-468:02
リリース日:
2014/07/28 Monday - 20:29
題名:
httpd-2.2.15-31.0.1.AXS4
影響のあるチャネル:
Asianux Server 4 for x86
Asianux Server 4 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Apache HTTP サーバの mod_deflate モジュールの mod_deflate.c の deflate_in_filter 関数には，リクエストボディの伸張が有効な場合，より大きいサイズへ伸張する巧妙に細工されたリクエストデータによって，リモートの攻撃者がサービス拒否 (リソース消費) を引き起こす脆弱性があります。(CVE-2014-0118)
- Apache HTTP サーバの mod_status モジュールには競合条件が存在し，modules/generators/mod_status.c の status_handler 関数と modules/lua/lua_request.c の lua_ap_scoreboard_worker 関数内の不適切な scoreboard 処理を引き起こす巧妙に細工されたリクエストによって，リモートの攻撃者がサービス拒否 (ヒープベースのバッファーオーバーフロー) を引き起こす，あるいは機密の証明書情報を取得する，あるいは任意のコードを実行する脆弱性があります。(CVE-2014-0226)
- Apache HTTP サーバの mod_cgid モジュールには，タイムアウトメカニズムがなく，標準入力ファイルディスクリプタから読み込まない CGI スクリプトへのリクエストによって，リモートの攻撃者がサービス拒否 (プロセスのハング) を引き起こす脆弱性があります。(CVE-2014-0231)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2014-0118
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
CVE-2014-0226
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
CVE-2014-0231
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.
追加情報:
N/A
ダウンロード:
SRPMS
- httpd-2.2.15-31.0.1.AXS4.src.rpm
MD5: a24e4f58a9460ee42f50039923df675f
SHA-256: f2bdca33ef141e1d07e9bfacc38b3f0747177e0d6958f32ba588429d7c3f1953
Size: 6.40 MB
Asianux Server 4 for x86
- httpd-2.2.15-31.0.1.AXS4.i686.rpm
MD5: 160dd0d58d7de34026035cbb9e7af60a
SHA-256: e8165b7f49b97db1d1a3d2aa285c01daf5ff9c1cfc3a0e2017ff2b014b03f2bb
Size: 826.89 kB - httpd-devel-2.2.15-31.0.1.AXS4.i686.rpm
MD5: 717e5bdef68e47b90555d590d4ceb36c
SHA-256: 024e90cee55c64f0704eab83296011a9f87d2f9d6c7043b41399e9a26db1011e
Size: 150.19 kB - httpd-manual-2.2.15-31.0.1.AXS4.noarch.rpm
MD5: cbfb50efa16f5b92baa3e949aee6926f
SHA-256: 23e11fc908bc46878d7b9a9376c7b1844f59ad0e49a27060f4a6dc0dab0cc17e
Size: 783.41 kB - httpd-tools-2.2.15-31.0.1.AXS4.i686.rpm
MD5: 4e765041bc0aa952f116637664bc8949
SHA-256: 9f709d0d252bb59dd61d0821daa4ab15538e8147a7f3e7e26415d1d2509d946e
Size: 73.33 kB - mod_ssl-2.2.15-31.0.1.AXS4.i686.rpm
MD5: 2983ea4dc446d277f2d7e05e794e0584
SHA-256: 37b1bba63d4a54648ebd9c73f36fe660b24cb79097f908b45e30e42c0148fedf
Size: 91.27 kB
Asianux Server 4 for x86_64
- httpd-2.2.15-31.0.1.AXS4.x86_64.rpm
MD5: 14ed7fb1a0e57530b8dc5d35c65a0ee8
SHA-256: 6fe2ff293db3e5b796ebd449f18895de5fb06fe0807e8e310937e0faec7eb4fa
Size: 822.64 kB - httpd-devel-2.2.15-31.0.1.AXS4.x86_64.rpm
MD5: 8af4ea80f6a85a0332d674120d2cbf8e
SHA-256: 777f3a00c94fb6d769e3c6354658e8564215ab0298a0ad9642a3113b3f691bea
Size: 149.71 kB - httpd-manual-2.2.15-31.0.1.AXS4.noarch.rpm
MD5: eed9fb476d62fe6e95bd8d2a2c216fd0
SHA-256: 30029b8dd6018f01fe20a795ac56ad426a19708f747c28f8835a184981afd460
Size: 782.89 kB - httpd-tools-2.2.15-31.0.1.AXS4.x86_64.rpm
MD5: 6fac19cce77619b288442fb2f2fc6d4a
SHA-256: ba02d7f4c7bdf722c62e267ff82b5fc336dcad052ae14c2c49ee8f64506b609b
Size: 72.27 kB - mod_ssl-2.2.15-31.0.1.AXS4.x86_64.rpm
MD5: 36f6953cd9a43e263edbb09bc0c95482
SHA-256: 34b78df466de2829471f9e1f356376366bff9ccc5fa7caaada987441f5e81a62
Size: 89.84 kB - httpd-devel-2.2.15-31.0.1.AXS4.i686.rpm
MD5: 717e5bdef68e47b90555d590d4ceb36c
SHA-256: 024e90cee55c64f0704eab83296011a9f87d2f9d6c7043b41399e9a26db1011e
Size: 150.19 kB