Executive Summary

Summary
Title Apache HTTP Server vulnerabilities
Informations
Name USN-3937-1 First vendor Publication 2019-04-04
Vendor Ubuntu Last vendor Modification 2019-04-04
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10 - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the Apache HTTP Server.

Software Description: - apache2: Apache HTTP server

Details:

Charles Fol discovered that the Apache HTTP Server incorrectly handled the scoreboard shared memory area. A remote attacker able to upload and run scripts could possibly use this issue to execute arbitrary code with root privileges. (CVE-2019-0211)

It was discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-17189)

It was discovered that the Apache HTTP Server incorrectly handled session expiry times. When used with mod_session_cookie, this may result in the session expiry time to be ignored, contrary to expectations. (CVE-2018-17199)

Craig Young discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to process requests incorrectly. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-0196)

Simon Kappel discovered that the Apache HTTP Server mod_auth_digest module incorrectly handled threads. A remote attacker with valid credentials could possibly use this issue to authenticate using another username, bypassing access control restrictions. (CVE-2019-0217)

Bernhard Lorenz discovered that the Apache HTTP Server was inconsistent when processing requests containing multiple consecutive slashes. This could lead to directives such as LocationMatch and RewriteRule to perform contrary to expectations. (CVE-2019-0220)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10:
apache2-bin 2.4.34-1ubuntu2.1

Ubuntu 18.04 LTS:
apache2-bin 2.4.29-1ubuntu4.6

Ubuntu 16.04 LTS:
apache2-bin 2.4.18-2ubuntu3.10

Ubuntu 14.04 LTS:
apache2-bin 2.4.7-1ubuntu4.22

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3937-1
CVE-2018-17189, CVE-2018-17199, CVE-2019-0196, CVE-2019-0211,
CVE-2019-0217, CVE-2019-0220

Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.34-1ubuntu2.1
https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.6
https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.10
https://launchpad.net/ubuntu/+source/apache2/2.4.7-1ubuntu4.22

Original Source

Url : http://www.ubuntu.com/usn/USN-3937-1

CWE : Common Weakness Enumeration

% Id Name
17 % CWE-416 Use After Free
17 % CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
17 % CWE-399 Resource Management Errors
17 % CWE-384 Session Fixation
17 % CWE-362 Race Condition
17 % CWE-264 Permissions, Privileges, and Access Controls

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 250
Application 1
Application 1
Application 1
Application 2
Application 1
Application 2
Os 5
Os 2
Os 3
Os 1
Os 2
Os 1
Os 1
Os 1
Os 1

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2019-06-12 05:21:45
  • Multiple Updates
2019-04-10 21:21:47
  • Multiple Updates
2019-04-09 05:21:23
  • Multiple Updates
2019-04-04 21:19:03
  • First insertion