New apr-util (and apr) packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. The issues are with apr-util, but older Slackware releases will require a new version of the apr package as well.

Updated apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

apr-util is a utility library used with the Apache Portable Runtime (APR). It aims to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR;
including support for XML, LDAP, database interfaces, URI parsing, and more.

An off-by-one overflow flaw was found in the way apr-util processed a variable list of arguments. An attacker could provide a specially crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive information or a denial of service (application crash). (CVE-2009-1956)

Note: The CVE-2009-1956 flaw only affects big-endian platforms, such as the IBM S/390 and PowerPC. It does not affect users using the apr-util package on little-endian platforms, due to their different organization of byte ordering used to represent particular data.

A denial of service flaw was found in the apr-util Extensible Markup Language (XML) parser. A remote attacker could create a specially crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine. (CVE-2009-1955)

A heap-based underwrite flaw was found in the way apr-util created compiled forms of particular search patterns. An attacker could formulate a specially crafted search keyword, that would overwrite arbitrary heap memory locations when processed by the pattern preparation engine. (CVE-2009-0023)

All apr-util users should upgrade to these updated packages, which contain backported patches to correct these issues. Applications using the Apache Portable Runtime library, such as httpd, must be restarted for this update to take effect.

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server. The httpd package shipped with Red Hat Enterprise Linux 3 contains an embedded copy of the Apache Portable Runtime (APR) utility library, a free library of C data structures and routines, which includes interfaces to support XML parsing, LDAP connections, database interfaces, URI parsing, and more.

An off-by-one overflow flaw was found in the way apr-util processed a variable list of arguments. An attacker could provide a specially crafted string as input for the formatted output conversion routine, which could, on big-endian platforms, potentially lead to the disclosure of sensitive information or a denial of service (application crash). (CVE-2009-1956)

Note: The CVE-2009-1956 flaw only affects big-endian platforms, such as the IBM S/390 and PowerPC. It does not affect users using the httpd package on little-endian platforms, due to their different organization of byte ordering used to represent particular data.

A denial of service flaw was found in the apr-util Extensible Markup Language (XML) parser. A remote attacker could create a specially crafted XML document that would cause excessive memory consumption when processed by the XML decoding engine. (CVE-2009-1955)

A heap-based underwrite flaw was found in the way apr-util created compiled forms of particular search patterns. An attacker could formulate a specially crafted search keyword, that would overwrite arbitrary heap memory locations when processed by the pattern preparation engine. (CVE-2009-0023)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

This update of libapr-util1 fixes a memory consumption bug in the XML parser that can cause a remote denial-of-service vulnerability in applications using APR (WebDAV for example) (CVE-2009-1955).
Additionally a one byte buffer overflow in function apr_brigade_vprintf() (CVE-2009-1956) and buffer underflow in function apr_strmatch_precompile() (CVE-2009-0023) was fixed too. Depending on the application using this function it can lead to remote denial of service or information leakage.

Apache ChangeLog reports :

CVE-2009-1891: Fix a potential Denial-of-Service attack against mod_deflate or other modules.

CVE-2009-1195: Prevent the 'Includes' Option from being enabled in an .htaccess file if the AllowOverride restrictions do not permit it.

CVE-2009-1890: Fix a potential Denial-of-Service attack against mod_proxy in a reverse proxy configuration.

CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous request which failed to send a request body.

CVE-2009-0023, CVE-2009-1955, CVE-2009-1956: The bundled copy of the APR-util library has been updated, fixing three different security issues which may affect particular configurations and third-party modules (was already fixed in 2.2.11_5).

IBM WebSphere Application Server 6.1 before Fix Pack 27 appears to be running on the remote host.  As such, it is reportedly affected by multiple vulnerabilities :

  - The Eclipse help system included with WebSphere     Application Server is affected by a cross-site     scripting vulnerability. (PK78917)

  - It may be possible to bypass security restrictions     using a specially crafted HTTP HEAD method. (PK83258)

  - New applications deployed in WebSphere Application     Server for z/OS prior to 1.8 are saved on the file     system with insecure privileges resulting in     disclosure of sensitive information. (PK83308)

  - If JAAS-J2C Authentication Data is configured using     wsadmin scripts, the password value may appear in     FFDC logs. (PK86137)

  - Apache APR-util is affected by a denial of service     issue. (PK88341)

  - Due to an error in expat XML parser, APR-util is     affected by a denial of service issue. (PK88342)

  - It may be possible to trigger a denial of service     attack due to errors in Fix Packs 6.1.0.23 and     6.1.0.25. (PK91709)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
39422	Slackware 11.0 / 12.0 / 12.1 / 12.2 / current : apr-util (SSA:2009-167-02)	Nessus	Slackware Local Security Checks	2009/6/17	2021/1/14	high
39431	RHEL 4 / 5 : apr-util (RHSA-2009:1107)	Nessus	Red Hat Local Security Checks	2009/6/17	2021/1/14	high
39432	RHEL 3 : httpd (RHSA-2009:1108)	Nessus	Red Hat Local Security Checks	2009/6/17	2021/1/14	high
40256	openSUSE Security Update : libapr-util1 (libapr-util1-968)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
40760	FreeBSD : apache22 -- several vulnerabilities (e15f2356-9139-11de-8f42-001aa0166822)	Nessus	FreeBSD Local Security Checks	2009/8/25	2021/1/6	high
40022	openSUSE Security Update : libapr-util1 (libapr-util1-968)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	high
41057	IBM WebSphere Application Server < 6.1.0.27 Multiple Vulnerabilities	Nessus	Web Servers	2009/9/23	2018/8/6	medium

検出

プラグインの検索

high

high

high

high

high

high

medium