USN-908-1: Apache vulnerabilities

Packages

apache2 -

Details

It was discovered that mod_proxy_ajp did not properly handle errors when
a client doesn’t send a request body. A remote attacker could exploit this
with a crafted request and cause a denial of service. This issue affected
Ubuntu 8.04 LTS, 8.10, 9.04 and 9.10. (CVE-2010-0408)

It was discovered that Apache did not properly handle headers in
subrequests under certain conditions. A remote attacker could exploit this
with a crafted request and possibly obtain sensitive information from
previous requests. (CVE-2010-0434)

It was discovered that mod_proxy_ajp did not properly handle errors when
a client doesn’t send a request body. A remote attacker could exploit this
with a crafted request and cause a denial of service. This issue affected
Ubuntu 8.04 LTS, 8.10, 9.04 and 9.10. (CVE-2010-0408)

It was discovered that Apache did not properly handle headers in
subrequests under certain conditions. A remote attacker could exploit this
with a crafted request and possibly obtain sensitive information from
previous requests. (CVE-2010-0434)

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
9.10 karmic	apache2.2-common – 2.2.12-1ubuntu2.2
9.04 jaunty	apache2.2-common – 2.2.11-2ubuntu2.6
8.10 intrepid	apache2.2-common – 2.2.9-7ubuntu3.6
8.04 hardy	apache2.2-common – 2.2.8-1ubuntu0.15
6.06 dapper	apache2-common – 2.0.55-4ubuntu2.10

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References