cpet/freebsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- document Apache httpd-2.4.x defects

Browse Source
This commit is contained in:
Olli Hauer 2016-12-21 10:35:20 +00:00
parent f5ba21fcbb
commit 6390c2348a
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=429061
1 changed files with 104 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
security/vuxml/vuln.xml
View File

@ -58,6 +58,110 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="862d6ab3-c75e-11e6-9f98-20cf30e32f6d">
<topic>Apache httpd -- several vulnerabilities</topic>
<affects>
<package>
<name>apache24</name>
<range><lt>2.4.25</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Apache Software Foundation reports:</p>
<blockquote cite="http://httpd.apache.org/security/vulnerabilities_24.html">
<ul>
<li>TBD: Apache HTTP Request Parsing Whitespace Defects CVE-2016-8743<br/>
Apache HTTP Server, prior to release 2.4.25, accepted a broad
pattern of unusual whitespace patterns from the user-agent,
including bare CR, FF, VTAB in parsing the request line and
request header lines, as well as HTAB in parsing the request line.
Any bare CR present in request lines was treated as whitespace and
remained in the request field member "the_request", while a bare
CR in the request header field name would be honored as
whitespace, and a bare CR in the request header field value was
retained the input headers array. Implied additional whitespace
was accepted in the request line and prior to the
':' delimiter of any request header lines.<br/><br/>
RFC7230 Section 3.5 calls out some of these whitespace exceptions,
and section 3.2.3 eliminated and clarified the role of implied
whitespace in the grammer of this specification. Section 3.1.1
requires exactly one single SP between the method and
request-target, and between the request-target and HTTP-version,
followed immediately by a CRLF sequence. None of these
fields permit any (unencoded) CTL character whatsoever. Section
3.2.4 explicitly disallowed any whitespace from the request header
field prior to the ':' character, while Section 3.2 disallows all
CTL characters in the request header line other than the HTAB
character as whitespace.<br/><br/>
These defects represent a security concern when httpd is
participating in any chain of proxies or interacting with back-end
application servers, either through mod_proxy or using conventional
CGI mechanisms. In each case where one agent accepts such CTL
characters and does not treat them as whitespace, there is the
possiblity in a proxy chain of generating two responses from a
server behind the uncautious proxy agent. In a sequence of two
requests, this results in request A to the first proxy being
interpreted as requests A + A' by the backend server, and if
requests A and B were submitted to the first proxy in a keepalive
connection, the proxy may interpret response A' as the response to
request B, polluting the cache or potentially serving the A' content
to a different downstream user-agent.<br/><br/>
These defects are addressed with the release of Apache HTTP Server
2.4.25 and coordinated by a new directive<br/>
HttpProtocolOptions Strict<br/>
</li>
</ul><ul>
<li>low: DoS vulnerability in mod_auth_digest CVE-2016-2161<br/>
Malicious input to mod_auth_digest will cause the server to crash,
and each instance continues to crash even for subsequently valid
requests.<br/>
</li>
</ul><ul>
<li>low: Padding Oracle in Apache mod_session_crypto CVE-2016-0736<br/>
Authenticate the session data/cookie presented to mod_session_crypto
with a MAC (SipHash) to prevent deciphering or tampering with a
padding oracle attack.<br/>
</li>
</ul><ul>
<li>low: Padding Oracle in Apache mod_session_crypto CVE-2016-0736<br/>
Authenticate the session data/cookie presented to mod_session_crypto
with a MAC (SipHash) to prevent deciphering or tampering with a
padding oracle attack.<br/>
</li>
</ul><ul>
<li>n/a: HTTP/2 CONTINUATION denial of service CVE-2016-8740<br/>
The HTTP/2 protocol implementation (mod_http2) had an incomplete
handling of the LimitRequestFields directive. This allowed an
attacker to inject unlimited request headers into the server,
leading to eventual memory exhaustion.<br/>
</li>
</ul><ul>
<li>n/a: HTTP_PROXY environment variable "httpoxy" mitigation CVE-2016-5387<br/>
HTTP_PROXY is a well-defined environment variable in a CGI process,
which collided with a number of libraries which failed to avoid
colliding with this CGI namespace. A mitigation is provided for the
httpd CGI environment to avoid populating the "HTTP_PROXY" variable
from a "Proxy:" header, which has never been registered by IANA.
</li>
</ul>
</blockquote>
</body>
</description>
<references>
<url>http://httpd.apache.org/security/vulnerabilities_24.html</url>
<cvename>CVE-2016-8743</cvename>
<cvename>CVE-2016-2161</cvename>
<cvename>CVE-2016-0736</cvename>
<cvename>CVE-2016-8740</cvename>
<cvename>CVE-2016-5387</cvename>
</references>
<dates>
<discovery>2016-12-20</discovery>
<entry>2016-12-21</entry>
</dates>
</vuln>
<vuln vid="942433db-c661-11e6-ae1b-002590263bf5">
<topic>xen-kernel -- x86: Mishandling of SYSCALL singlestep during emulation</topic>
<affects>