1. Ubuntu Security Notices
  2. USN-802-1

USN-802-1: Apache vulnerabilities

Publication date

13 July 2009

Overview

Apache vulnerabilities

Releases

Packages

Details

It was discovered that mod_proxy_http did not properly handle a large
amount of streamed data when used as a reverse proxy. A remote attacker
could exploit this and cause a denial of service via memory resource
consumption. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.04.
(CVE-2009-1890)

It was discovered that mod_deflate did not abort compressing large files
when the connection was closed. A remote attacker could exploit this and
cause a denial of service via CPU resource consumption. (CVE-2009-1891)

It was discovered that mod_proxy_http did not properly handle a large
amount of streamed data when used as a reverse proxy. A remote attacker
could exploit this and cause a denial of service via memory resource
consumption. This issue affected Ubuntu 8.04 LTS, 8.10 and 9.04.
(CVE-2009-1890)

It was discovered that mod_deflate did not abort compressing large files
when the connection was closed. A remote attacker could exploit this and
cause a denial of service via CPU resource consumption. (CVE-2009-1891)

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.04 jaunty apache2-mpm-worker –  2.2.11-2ubuntu2.2
apache2-mpm-event –  2.2.11-2ubuntu2.2
apache2.2-common –  2.2.11-2ubuntu2.2
apache2-mpm-prefork –  2.2.11-2ubuntu2.2
8.10 intrepid apache2-mpm-worker –  2.2.9-7ubuntu3.2
apache2-mpm-event –  2.2.9-7ubuntu3.2
apache2.2-common –  2.2.9-7ubuntu3.2
apache2-mpm-prefork –  2.2.9-7ubuntu3.2
8.04 hardy apache2-mpm-worker –  2.2.8-1ubuntu0.10
apache2-mpm-event –  2.2.8-1ubuntu0.10
apache2.2-common –  2.2.8-1ubuntu0.10
apache2-mpm-prefork –  2.2.8-1ubuntu0.10
apache2-mpm-perchild –  2.2.8-1ubuntu0.10
6.06 dapper apache2-mpm-worker –  2.0.55-4ubuntu2.6
apache2-mpm-perchild –  2.0.55-4ubuntu2.6
libapr0 –  2.0.55-4ubuntu2.6
apache2-mpm-prefork –  2.0.55-4ubuntu2.6
apache2-common –  2.0.55-4ubuntu2.6

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›