1. Ubuntu Security Notices
  2. USN-2299-1

USN-2299-1: Apache HTTP Server vulnerabilities

Publication date

23 July 2014

Overview

Several security issues were fixed in Apache HTTP Server.

Releases

Packages

Details

Marek Kroemeke discovered that the mod_proxy module incorrectly handled
certain requests. A remote attacker could use this issue to cause the
server to stop responding, leading to a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2014-0117)

Giancarlo Pellegrino and Davide Balzarotti discovered that the mod_deflate
module incorrectly handled body decompression. A remote attacker could use
this issue to cause resource consumption, leading to a denial of service.
(CVE-2014-0118)

Marek Kroemeke and others discovered that the mod_status module incorrectly
handled certain requests. A remote attacker could use this issue to cause
the server to stop responding, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2014-0226)

Rainer Jung discovered that the mod_cgid module...

Marek Kroemeke discovered that the mod_proxy module incorrectly handled
certain requests. A remote attacker could use this issue to cause the
server to stop responding, leading to a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2014-0117)

Giancarlo Pellegrino and Davide Balzarotti discovered that the mod_deflate
module incorrectly handled body decompression. A remote attacker could use
this issue to cause resource consumption, leading to a denial of service.
(CVE-2014-0118)

Marek Kroemeke and others discovered that the mod_status module incorrectly
handled certain requests. A remote attacker could use this issue to cause
the server to stop responding, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2014-0226)

Rainer Jung discovered that the mod_cgid module incorrectly handled certain
scripts. A remote attacker could use this issue to cause the server to stop
responding, leading to a denial of service. (CVE-2014-0231)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
14.04 trusty apache2-bin –  2.4.7-1ubuntu4.1
12.04 precise apache2.2-bin –  2.2.22-1ubuntu1.7
10.04 lucid apache2.2-bin –  2.2.14-5ubuntu8.14

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›