ID

VAR-201302-0049

CVE

CVE-2012-4558

TITLE

Apache HTTP Server of mod_proxy_balancer Module cross-site scripting vulnerability

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string. An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. Apache HTTP Server versions prior to 2.4.4 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Enterprise Application Platform 6.1.1 update Advisory ID: RHSA-2013:1207-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://rhn.redhat.com/errata/RHSA-2013-1207.html Issue date: 2013-09-04 CVE Names: CVE-2012-3499 CVE-2012-4558 CVE-2013-1862 CVE-2013-1896 CVE-2013-1921 CVE-2013-2172 CVE-2013-4112 ===================================================================== 1. Summary: Red Hat JBoss Enterprise Application Platform 6.1.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server - i386, noarch, x86_64 3. Description: Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.1.0, and includes bug fixes and enhancements. Refer to the 6.1.1 Release Notes for information on the most significant of these changes, available shortly from https://access.redhat.com/site/documentation/ Security fixes: Cross-site scripting (XSS) flaws were found in the mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp modules. An attacker could possibly use these flaws to perform XSS attacks if they were able to make the victim's browser generate an HTTP request with a specially-crafted Host header. (CVE-2012-3499) Cross-site scripting (XSS) flaws were found in the mod_proxy_balancer module's manager web interface. (CVE-2012-4558) A flaw was found in the way the mod_dav module handled merge requests. An attacker could use this flaw to send a crafted merge request that contains URIs that are not configured for DAV, causing the httpd child process to crash. (CVE-2013-1896) A flaw was found in the way Apache Santuario XML Security for Java validated XML signatures. Santuario allowed a signature to specify an arbitrary canonicalization algorithm, which would be applied to the SignedInfo XML fragment. A remote attacker could exploit this to spoof an XML signature via a specially-crafted XML signature block. (CVE-2013-2172) It was found that mod_rewrite did not filter terminal escape sequences from its log file. If mod_rewrite was configured with the RewriteLog directive, a remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the mod_rewrite log file. If a victim viewed the log file with a terminal emulator, it could result in arbitrary command execution with the privileges of that user. (CVE-2013-1862) The data file used by PicketBox Vault to store encrypted passwords contains a copy of its own admin key. The file is encrypted using only this admin key, not the corresponding JKS key. A local attacker with permission to read the vault data file could read the admin key from the file, and use it to decrypt the file and read the stored passwords in clear text. This could be exploited to read diagnostic information (information disclosure) and attain limited remote code execution. (CVE-2013-4112) Warning: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. Refer to the Solution section for further details. All users of Red Hat JBoss Enterprise Application Platform 6.1.0 on Red Hat Enterprise Linux 5 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Also, back up any customized Red Hat JBoss Enterprise Application Platform 6 configuration files. On update, the configuration files that have been locally modified will not be updated. The updated version of such files will be stored as the rpmnew files. Make sure to locate any such files after the update and merge any changes manually. For more details, refer to the Release Notes for Red Hat JBoss Enterprise Application Platform 6.1.1, available shortly from https://access.redhat.com/site/documentation/ This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 915883 - CVE-2012-3499 httpd: multiple XSS flaws due to unescaped hostnames 915884 - CVE-2012-4558 httpd: XSS flaw in mod_proxy_balancer manager interface 948106 - CVE-2013-1921 JBoss PicketBox: Insecure storage of masked passwords 953729 - CVE-2013-1862 httpd: mod_rewrite allows terminal escape sequences to be written to the log file 983489 - CVE-2013-4112 JGroups: Authentication via cached credentials 983549 - CVE-2013-1896 httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav 988076 - Upgrade jcip-annotations-eap6 to 1.0-redhat-4 996642 - Upgrade jbossweb to 7.2.2.Final-redhat-1 (RHEL-5) 996644 - Upgrade jboss-as-console to 1.5.5.Final-redhat-1 (RHEL-5) 996645 - Upgrade jboss-hal to 1.5.6.Final-redhat-1 (RHEL-5) 996646 - Upgrade hornetq-native to 2.3.3.Final-redhat-1 (RHEL-5) 996647 - Upgrade picketbox to 4.0.17.SP2-redhat-1 (RHEL-5) 996648 - Upgrade picketlink-federation to 2.1.6.2.Final-redhat-2 (RHEL-5) 996649 - Upgrade jaxbintros to 1.0.2.GA-redhat-5 (RHEL-5) 996650 - Upgrade hornetq to 2.3.4.Final-redhat-1 (RHEL-5) 996651 - Upgrade jboss-aesh to 0.33.6-redhat-1 (RHEL-5) 996652 - Upgrade jboss-stdio to 1.0.2.GA-redhat-1 (RHEL-5) 996653 - Upgrade jbossws-common to 2.1.3.Final-redhat-1 (RHEL-5) 996654 - Upgrade jbossts to 4.17.7.Final-redhat-1 (RHEL-5) 996655 - Upgrade jboss-logmanager to 1.4.3.Final-redhat-1 (RHEL-5) 996697 - Upgrade jgroups to 3.2.10.Final-redhat-1 (RHEL-5) 999263 - CVE-2013-2172 Apache Santuario XML Security for Java: XML signature spoofing 6. Package List: Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-2.6.8-8.redhat_7.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/apache-cxf-xjc-utils-2.6.0-2.redhat_4.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hibernate4-4.2.0-11.SP1_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hornetq-2.3.5-2.Final_redhat_2.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/httpd-2.2.22-25.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/infinispan-5.2.7-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/ironjacamar-1.0.19-1.Final_redhat_2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jaxbintros-1.0.2-16.GA_redhat_6.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-aesh-0.33.7-2.redhat_2.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-cli-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-client-all-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-clustering-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-cmp-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-connector-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-console-1.5.6-2.Final_redhat_2.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-controller-client-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-deployment-repository-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-deployment-scanner-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-domain-http-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-domain-management-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-ee-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-ee-deployment-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-ejb3-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-embedded-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-host-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jacorb-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jaxr-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jaxrs-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jdr-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jpa-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jsf-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-jsr77-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-logging-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-mail-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-management-client-content-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-messaging-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-modcluster-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-naming-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-network-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-osgi-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-osgi-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-osgi-service-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-platform-mbean-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-pojo-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-process-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-protocol-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-remoting-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-sar-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-security-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-server-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-system-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-threads-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-transactions-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-version-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-web-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-webservices-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-weld-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-as-xts-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-ejb-client-1.0.23-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-hal-1.5.7-1.Final_redhat_1.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-invocation-1.1.2-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-jsp-api_2.2_spec-1.0.1-6.Final_redhat_2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-logmanager-1.4.3-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-marshalling-1.3.18-2.GA_redhat_1.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-modules-1.2.2-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-remote-naming-1.0.7-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-security-negotiation-2.2.5-2.Final_redhat_2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jboss-stdio-1.0.2-1.GA_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-bundles-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-core-7.2.1-6.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-domain-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-javadocs-7.2.1-2.Final_redhat_10.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-modules-eap-7.2.1-9.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-product-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-standalone-7.2.1-6.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossas-welcome-content-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossts-4.17.7-4.Final_redhat_4.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossweb-7.2.2-1.Final_redhat_1.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-common-2.1.3-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-cxf-4.1.4-7.Final_redhat_7.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jbossws-spi-2.1.3-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jcip-annotations-eap6-1.0-4.redhat_4.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/jgroups-3.2.10-1.Final_redhat_2.2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/log4j-jboss-logmanager-1.0.2-1.Final_redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/netty-3.6.6-3.Final_redhat_1.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/opensaml-2.5.1-2.redhat_2.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/openws-1.4.2-10.redhat_4.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/picketbox-4.0.17-3.SP2_redhat_2.1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/picketlink-federation-2.1.6.3-2.Final_redhat_2.2.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/wss4j-1.6.10-1.redhat_1.ep6.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/JBEAP/SRPMS/xml-security-1.5.5-1.redhat_1.ep6.el5.src.rpm i386: apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el5.i386.rpm apache-commons-daemon-jsvc-eap6-debuginfo-1.0.15-2.redhat_2.ep6.el5.i386.rpm hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.i386.rpm hornetq-native-debuginfo-2.3.5-1.Final_redhat_1.ep6.el5.i386.rpm httpd-2.2.22-25.ep6.el5.i386.rpm httpd-debuginfo-2.2.22-25.ep6.el5.i386.rpm httpd-devel-2.2.22-25.ep6.el5.i386.rpm httpd-tools-2.2.22-25.ep6.el5.i386.rpm jbossas-hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.i386.rpm mod_ssl-2.2.22-25.ep6.el5.i386.rpm noarch: apache-commons-beanutils-1.8.3-12.redhat_3.2.ep6.el5.noarch.rpm apache-cxf-2.6.8-8.redhat_7.1.ep6.el5.noarch.rpm apache-cxf-xjc-utils-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm cxf-xjc-boolean-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm cxf-xjc-dv-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm cxf-xjc-ts-2.6.0-2.redhat_4.1.ep6.el5.noarch.rpm hibernate4-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm hibernate4-core-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm hibernate4-entitymanager-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm hibernate4-envers-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm hibernate4-infinispan-4.2.0-11.SP1_redhat_1.ep6.el5.noarch.rpm hornetq-2.3.5-2.Final_redhat_2.1.ep6.el5.noarch.rpm infinispan-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm infinispan-cachestore-jdbc-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm infinispan-cachestore-remote-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm infinispan-client-hotrod-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm infinispan-core-5.2.7-1.Final_redhat_1.ep6.el5.noarch.rpm ironjacamar-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-common-api-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-common-impl-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-common-spi-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-core-api-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-core-impl-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-deployers-common-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-jdbc-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-spec-api-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm ironjacamar-validator-1.0.19-1.Final_redhat_2.ep6.el5.noarch.rpm jaxbintros-1.0.2-16.GA_redhat_6.ep6.el5.noarch.rpm jboss-aesh-0.33.7-2.redhat_2.1.ep6.el5.noarch.rpm jboss-as-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-cli-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-client-all-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-clustering-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-cmp-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-connector-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-console-1.5.6-2.Final_redhat_2.1.ep6.el5.noarch.rpm jboss-as-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-controller-client-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-deployment-repository-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-deployment-scanner-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-domain-http-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-domain-management-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-ee-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-ee-deployment-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-ejb3-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-embedded-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-host-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jacorb-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jaxr-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jaxrs-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jdr-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jpa-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jsf-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-jsr77-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-logging-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-mail-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-management-client-content-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-messaging-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-modcluster-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-naming-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-network-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-osgi-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-osgi-configadmin-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-osgi-service-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-platform-mbean-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-pojo-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-process-controller-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-protocol-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-remoting-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-sar-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-security-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-server-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-system-jmx-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-threads-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-transactions-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-version-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-web-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-webservices-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-weld-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-as-xts-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jboss-ejb-client-1.0.23-1.Final_redhat_1.ep6.el5.noarch.rpm jboss-hal-1.5.7-1.Final_redhat_1.1.ep6.el5.noarch.rpm jboss-invocation-1.1.2-1.Final_redhat_1.ep6.el5.noarch.rpm jboss-jsp-api_2.2_spec-1.0.1-6.Final_redhat_2.ep6.el5.noarch.rpm jboss-logmanager-1.4.3-1.Final_redhat_1.ep6.el5.noarch.rpm jboss-marshalling-1.3.18-2.GA_redhat_1.1.ep6.el5.noarch.rpm jboss-modules-1.2.2-1.Final_redhat_1.ep6.el5.noarch.rpm jboss-remote-naming-1.0.7-1.Final_redhat_1.ep6.el5.noarch.rpm jboss-security-negotiation-2.2.5-2.Final_redhat_2.ep6.el5.noarch.rpm jboss-stdio-1.0.2-1.GA_redhat_1.ep6.el5.noarch.rpm jbossas-appclient-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-bundles-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-core-7.2.1-6.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-domain-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-javadocs-7.2.1-2.Final_redhat_10.ep6.el5.noarch.rpm jbossas-modules-eap-7.2.1-9.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-product-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-standalone-7.2.1-6.Final_redhat_10.1.ep6.el5.noarch.rpm jbossas-welcome-content-eap-7.2.1-5.Final_redhat_10.1.ep6.el5.noarch.rpm jbossts-4.17.7-4.Final_redhat_4.ep6.el5.noarch.rpm jbossweb-7.2.2-1.Final_redhat_1.1.ep6.el5.noarch.rpm jbossws-common-2.1.3-1.Final_redhat_1.ep6.el5.noarch.rpm jbossws-cxf-4.1.4-7.Final_redhat_7.ep6.el5.noarch.rpm jbossws-spi-2.1.3-1.Final_redhat_1.ep6.el5.noarch.rpm jcip-annotations-eap6-1.0-4.redhat_4.ep6.el5.noarch.rpm jgroups-3.2.10-1.Final_redhat_2.2.ep6.el5.noarch.rpm log4j-jboss-logmanager-1.0.2-1.Final_redhat_1.ep6.el5.noarch.rpm netty-3.6.6-3.Final_redhat_1.1.ep6.el5.noarch.rpm opensaml-2.5.1-2.redhat_2.1.ep6.el5.noarch.rpm openws-1.4.2-10.redhat_4.1.ep6.el5.noarch.rpm picketbox-4.0.17-3.SP2_redhat_2.1.ep6.el5.noarch.rpm picketlink-federation-2.1.6.3-2.Final_redhat_2.2.ep6.el5.noarch.rpm wss4j-1.6.10-1.redhat_1.ep6.el5.noarch.rpm xml-security-1.5.5-1.redhat_1.ep6.el5.noarch.rpm x86_64: apache-commons-daemon-jsvc-eap6-1.0.15-2.redhat_2.ep6.el5.x86_64.rpm apache-commons-daemon-jsvc-eap6-debuginfo-1.0.15-2.redhat_2.ep6.el5.x86_64.rpm hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.x86_64.rpm hornetq-native-debuginfo-2.3.5-1.Final_redhat_1.ep6.el5.x86_64.rpm httpd-2.2.22-25.ep6.el5.x86_64.rpm httpd-debuginfo-2.2.22-25.ep6.el5.x86_64.rpm httpd-devel-2.2.22-25.ep6.el5.x86_64.rpm httpd-tools-2.2.22-25.ep6.el5.x86_64.rpm jbossas-hornetq-native-2.3.5-1.Final_redhat_1.ep6.el5.x86_64.rpm mod_ssl-2.2.22-25.ep6.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2012-3499.html https://www.redhat.com/security/data/cve/CVE-2012-4558.html https://www.redhat.com/security/data/cve/CVE-2013-1862.html https://www.redhat.com/security/data/cve/CVE-2013-1896.html https://www.redhat.com/security/data/cve/CVE-2013-1921.html https://www.redhat.com/security/data/cve/CVE-2013-2172.html https://www.redhat.com/security/data/cve/CVE-2013-4112.html https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/site/documentation/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFSJ4QEXlSAg2UNWIIRAgOPAJ4/KG6aDFsPx4v4TyM+IAw3D6nUCwCgpDCv Z/gZxr8tfBZOJfNWozZ6zSM= =FclZ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . CVE-2012-3499 The modules mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp did not properly escape hostnames and URIs in HTML output, causing cross site scripting vulnerabilities. CVE-2012-4558 Mod_proxy_balancer did not properly escape hostnames and URIs in its balancer-manager interface, causing a cross site scripting vulnerability. CVE-2013-1048 Hayawardh Vijayakumar noticed that the apache2ctl script created the lock directory in an unsafe manner, allowing a local attacker to gain elevated privileges via a symlink attack. For the stable distribution (squeeze), these problems have been fixed in version 2.2.16-6+squeeze11. For the testing distribution (wheezy), these problems will be fixed in version 2.2.22-13. For the unstable distribution (sid), these problems will be fixed in version 2.2.22-13. We recommend that you upgrade your apache2 packages. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03734195 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03734195 Version: 1 HPSBUX02866 SSRT101139 rev.1 - HP-UX Running Apache, Remote Denial of Service (DoS), Execution of Arbitrary Code and other vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2013-04-15 Last Updated: 2013-04-12 Potential Security Impact: Remote Denial of Service (DoS), execution of arbitrary code and other vulnerabilities Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Running Apache. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS) or to execute arbitrary code and other vulnerabilities. References: HP-UX Apache: CVE-2007-6750, CVE-2012-2687, CVE-2012-3499, CVE-2012-4557, CVE-2012 -4558, CVE-2012-4929 Tomcat v6.0 and v7.0: CVE-2012-2733, CVE-2012-3546, CVE-2012-4431, CVE-2012-4534, CVE-2012-5885 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.25 or earlier BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2007-6750 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-2687 (AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.6 CVE-2012-2733 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-3499 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2012-3546 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2012-4431 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2012-4534 (AV:N/AC:H/Au:N/C:N/I:N/A:P) 2.6 CVE-2012-4557 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2012-4558 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2012-4929 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6 CVE-2012-5885 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following software updates to resolve the vulnerability. The update for B.11.23 and B.11.31 is available for download from ftp://sb_02866:6hq{PM6a@ftp.usa.hp.com Web Server Suite Version Apache Depot Name HP-UX Web Server Suite v.3.26 containing Apache v2.2.15.15 and Tomcat B.5.5.36.01 HP-UX_11.23_HPUXWS22ATW-B326-11-23-64.depot HP-UX_11.23_HPUXWS22ATW-B326-11-23-32.depot HP-UX Web Server Suite v.3.26 containing Apache v2.2.15.15 and Tomcat C.6.0.36.01 HP-UX_11.31_HPUXWS22ATW-B326-11-31-64.depot HP-UX_11.31_HPUXWS22ATW-B326-11-31-32.depot Tomcat D.7.035.01 HP-UX_11.31_hpuxws22Tomcat_D.7.0.35.01_HP-UX_B.11.31_IA_PA.depot MANUAL ACTIONS: Yes - Update Install HP-UX Web Server Suite v3.26 or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.23 HP-UX B.11.31 ================== hpuxws22APCH32.APACHE hpuxws22APCH32.APACHE2 hpuxws22APCH32.AUTH_LDAP hpuxws22APCH32.AUTH_LDAP2 hpuxws22APCH32.MOD_JK hpuxws22APCH32.MOD_JK2 hpuxws22APCH32.MOD_PERL hpuxws22APCH32.MOD_PERL2 hpuxws22APCH32.PHP hpuxws22APCH32.PHP2 hpuxws22APCH32.WEBPROXY hpuxws22APCH32.WEBPROXY2 action: install revision B.2.2.15.15 or subsequent HP-UX B.11.31 ================== hpuxws22TOMCAT.TOMCAT action: install revision C.6.0.36.01 or subsequent HP-UX B.11.31 ================== hpuxws22TOMCAT.TOMCAT action: install revision D.7.0.35.01 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 15 April 2013 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin List: A list of HP Security Bulletins, updated periodically, is contained in HP Security Notice HPSN-2011-001: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c02964430 Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2013 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. (CVE-2012-3499) A NULL pointer dereference flaw was found in the OCSP response verification in OpenSSL. A malicious OCSP server could use this flaw to crash applications performing OCSP verification by sending a specially-crafted response. (CVE-2013-0166) It was discovered that OpenSSL leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a TLS/SSL or DTLS server as a padding oracle. (CVE-2013-0169) Note: CVE-2013-0166 and CVE-2013-0169 were only corrected in the packages for Solaris and Windows. A session fixation flaw was found in the Tomcat FormAuthenticator module. During a narrow window of time, if a remote attacker sent requests while a user was logging in, it could possibly result in the attacker's requests being processed as if they were sent by the user. (CVE-2013-2067) A denial of service flaw was found in the way the Tomcat chunked transfer encoding input filter processed CRLF sequences. Chunked transfer encoding is enabled by default. (CVE-2012-3544) A flaw was found in the way the Tomcat 7 asynchronous context implementation performed request management in certain circumstances. If an application used AsyncListeners and threw RuntimeExceptions, Tomcat could send a reply that contains information from a different user's request, possibly leading to the disclosure of sensitive information. This issue only affected Tomcat 7. Solution: The References section of this erratum contains a download link (you must log in to download the update). Bugs fixed (http://bugzilla.redhat.com/): 907589 - CVE-2013-0169 SSL/TLS: CBC padding timing attack (lucky-13) 908052 - CVE-2013-0166 openssl: DoS due to improper handling of OCSP response verification 915883 - CVE-2012-3499 httpd: multiple XSS flaws due to unescaped hostnames 915884 - CVE-2012-4558 httpd: XSS flaw in mod_proxy_balancer manager interface 961779 - CVE-2013-2067 tomcat: Session fixation in form authenticator 961783 - CVE-2012-3544 tomcat: Limited DoS in chunked transfer encoding input filter 961803 - CVE-2013-2071 tomcat: Information disclosure in asynchronous context when using AsyncListeners that threw RuntimeExceptions 5. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+ patches/packages/httpd-2.4.4-i486-1_slack14.0.txz: Upgraded. This update provides bugfixes and enhancements. [Jim Jagielski, Stefan Fritsch, Niels Heinen <heinenn google com>] * XSS in mod_proxy_balancer manager interface. [Jim Jagielski, Niels Heinen <heinenn google com>] For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3499 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4558 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/httpd-2.2.24-i486-1_slack12.1.tgz Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/httpd-2.2.24-i486-1_slack12.2.tgz Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/httpd-2.2.24-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/httpd-2.2.24-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/httpd-2.2.24-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/httpd-2.2.24-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/httpd-2.2.24-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/httpd-2.2.24-x86_64-1_slack13.37.txz Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.4-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.4-x86_64-1_slack14.0.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.4-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.4-x86_64-1.txz MD5 signatures: +-------------+ Slackware 12.1 package: cdc26999b5fd2787f1eaef285dad47bc httpd-2.2.24-i486-1_slack12.1.tgz Slackware 12.2 package: 7671b12ad7b163c1aba0fb7278349c0d httpd-2.2.24-i486-1_slack12.2.tgz Slackware 13.0 package: 5ca815faf37f28c2e365f47643d7b9a4 httpd-2.2.24-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 715fa297d5451dafdbe1b296565b3a08 httpd-2.2.24-x86_64-1_slack13.0.txz Slackware 13.1 package: 4246568ea7eada4c3c4dc6bd95464784 httpd-2.2.24-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 2ee64f87af8563132fccfe53e9f0f4c9 httpd-2.2.24-x86_64-1_slack13.1.txz Slackware 13.37 package: 252c123e2a3c03aff1aa2112050de945 httpd-2.2.24-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 9a5fcc681c89c131478910d999e25170 httpd-2.2.24-x86_64-1_slack13.37.txz Slackware 14.0 package: 32d6ffa35ea58aaf4d9e325b857c4e11 httpd-2.4.4-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 889197760474094bce962f900f5258b1 httpd-2.4.4-x86_64-1_slack14.0.txz Slackware -current package: ae7a5606e6ec97ec74ab64bf7cde5c03 n/httpd-2.4.4-i486-1.txz Slackware x86_64 -current package: 09c32bd3fef0741e0743c0590e72f9d2 n/httpd-2.4.4-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg httpd-2.4.4-i486-1_slack14.0.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-09-12-1 OS X Mountain Lion v10.8.5 and Security Update 2013-004 OS X Mountain Lion v10.8.5 and Security Update 2013-004 is now available and addresses the following: Apache Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Multiple vulnerabilities in Apache Description: Multiple vulnerabilities existed in Apache, the most serious of which may lead to cross-site scripting. These issues were addressed by updating Apache to version 2.2.24. CVE-ID CVE-2012-0883 CVE-2012-2687 CVE-2012-3499 CVE-2012-4558 Bind Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Multiple vulnerabilities in BIND Description: Multiple vulnerabilities existed in BIND, the most serious of which may lead to a denial of service. These issues were addressed by updating BIND to version 9.8.5-P1. CVE-2012-5688 did not affect Mac OS X v10.7 systems. CVE-ID CVE-2012-3817 CVE-2012-4244 CVE-2012-5166 CVE-2012-5688 CVE-2013-2266 Certificate Trust Policy Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Root certificates have been updated Description: Several certificates were added to or removed from the list of system roots. The complete list of recognized system roots may be viewed via the Keychain Access application. ClamAV Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5 Impact: Multiple vulnerabilities in ClamAV Description: Multiple vulnerabilities exist in ClamAV, the most serious of which may lead to arbitrary code execution. This update addresses the issues by updating ClamAV to version 0.97.8. CVE-ID CVE-2013-2020 CVE-2013-2021 CoreGraphics Available for: OS X Mountain Lion v10.8 to v10.8.4 Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JBIG2 encoded data in PDF files. This issue was addressed through additional bounds checking. CVE-ID CVE-2013-1025 : Felix Groebert of the Google Security Team ImageIO Available for: OS X Mountain Lion v10.8 to v10.8.4 Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JPEG2000 encoded data in PDF files. This issue was addressed through additional bounds checking. CVE-ID CVE-2013-1026 : Felix Groebert of the Google Security Team Installer Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Packages could be opened after certificate revocation Description: When Installer encountered a revoked certificate, it would present a dialog with an option to continue. The issue was addressed by removing the dialog and refusing any revoked package. CVE-ID CVE-2013-1027 IPSec Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: An attacker may intercept data protected with IPSec Hybrid Auth Description: The DNS name of an IPSec Hybrid Auth server was not being matched against the certificate, allowing an attacker with a certificate for any server to impersonate any other. This issue was addressed by properly checking the certificate. CVE-ID CVE-2013-1028 : Alexander Traud of www.traud.de Kernel Available for: OS X Mountain Lion v10.8 to v10.8.4 Impact: A local network user may cause a denial of service Description: An incorrect check in the IGMP packet parsing code in the kernel allowed a user who could send IGMP packets to the system to cause a kernel panic. The issue was addressed by removing the check. CVE-ID CVE-2013-1029 : Christopher Bohn of PROTECTSTAR INC. Mobile Device Management Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Passwords may be disclosed to other local users Description: A password was passed on the command-line to mdmclient, which made it visible to other users on the same system. The issue was addressed by communicating the password through a pipe. CVE-ID CVE-2013-1030 : Per Olofsson at the University of Gothenburg OpenSSL Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Multiple vulnerabilities in OpenSSL Description: Multiple vulnerabilities existed in OpenSSL, the most serious of which may lead to disclosure of user data. These issues were addressed by updating OpenSSL to version 0.9.8y. CVE-ID CVE-2012-2686 CVE-2013-0166 CVE-2013-0169 PHP Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Multiple vulnerabilities in PHP Description: Multiple vulnerabilities existed in PHP, the most serious of which may lead to arbitrary code execution. These issues were addressed by updating PHP to version 5.3.26. CVE-ID CVE-2013-1635 CVE-2013-1643 CVE-2013-1824 CVE-2013-2110 PostgreSQL Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Multiple vulnerabilities in PostgreSQL Description: Multiple vulnerabilities exist in PostgreSQL, the most serious of which may lead to data corruption or privilege escalation. This update addresses the issues by updating PostgreSQL to version 9.0.13. CVE-ID CVE-2013-1899 CVE-2013-1900 CVE-2013-1901 CVE-2013-1902 CVE-2013-1903 Power Management Available for: OS X Mountain Lion v10.8 to v10.8.4 Impact: The screen saver may not start after the specified time period Description: A power assertion lock issue existed. This issue was addressed through improved lock handling. CVE-ID CVE-2013-1031 QuickTime Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7.5, OS X Lion Server v10.7.5, OS X Mountain Lion v10.8 to v10.8.4 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the handling of 'idsc' atoms in QuickTime movie files. This issue was addressed through additional bounds checking. CVE-ID CVE-2013-1032 : Jason Kratzer working with iDefense VCP Screen Lock Available for: OS X Mountain Lion v10.8 to v10.8.4 Impact: A user with screen sharing access may be able to bypass the screen lock when another user is logged in Description: A session management issue existed in the screen lock's handling of screen sharing sessions. This issue was addressed through improved session tracking. CVE-ID CVE-2013-1033 : Jeff Grisso of Atos IT Solutions, Sebastien Stormacq Note: OS X Mountain Lion v10.8.5 also addresses an issue where certain Unicode strings could cause applications to unexpectedly terminate. OS X Mountain Lion v10.8.5 and Security Update 2013-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The Software Update utility will present the update that applies to your system configuration. Only one is needed, either OS X Mountain Lion v10.8.5, or Security Update 2013-004. For OS X Mountain Lion v10.8.4 The download file is named: OSXUpd10.8.5.dmg Its SHA-1 digest is: a74ab6d9501778437e7afba0bbed47b776a52b11 For OS X Mountain Lion v10.8 and v10.8.3 The download file is named: OSXUpdCombo10.8.5.dmg Its SHA-1 digest is: cb798ac9b97ceb2d8875af040ce4ff06187d61f2 For OS X Lion v10.7.5 The download file is named: SecUpd2013-004.dmg Its SHA-1 digest is: dbc50fce7070f83b93b866a21b8f5c6e65007fa0 For OS X Lion Server v10.7.5 The download file is named: SecUpdSrvr2013-004.dmg Its SHA-1 digest is: 44a77edbd37732b865bc21a9aac443a3cdc47355 For Mac OS X v10.6.8 The download file is named: SecUpd2013-004.dmg Its SHA-1 digest is: d07d5142a2549270f0d2eaddb262b41bb5c16b61 For Mac OS X Server v10.6.8 The download file is named: SecUpdSrvr2013-004.dmg Its SHA-1 digest is: 8f9abe93f7f9427cf86b89bd67df948a85537dbc Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSMiPGAAoJEPefwLHPlZEw9qMP/17D4Q8velZ3H4AumPzHqqB4 QxPcuv8PXzhi55epUm2bzNfXR9A5L9KvzEsmggqxO2/ESO0zfeKgAmXXjCI3z5Qc +WkHgqowjwXU9cbjyDkhwb/ylXml+vCSIv2m9eXXNRTRi0rm9ZLSI/JMSRfLMojQ bZbzQSoSpuGaOeOOWESKCf9zBXFG6DBGo0wg3z8Bkywjtp/7bfddPAFHxIdhjDDN 1IgmhPRnP6NEdNSfR6RwF94M+hyiJ2I2DIDZTIo+6B4Ne90bEYdBiQmSxwKFAyc3 H9VFfB8XmrtA2k4DhE6Ow2jD/Y//QKz6TbyZNSQawXxuPsj43v6/T6BsWdfddGbQ hDGU85e7z7a4gmIPuS3DjMhSEyAixL/B3vKYBaZltH6JBCcPuLvGrU7nAiJa7KGQ 8MToOyv42TSj95drFzysk5fcO0MIUH5xiGlaU+ScEdBSpIpHDfpjeJYPqxHeGFaa V2xCGw1vMYbMoxNzRL0FPPdUxJkyBHvuzZXh6c6fATuQIPCtwejpPrYEo7x7RRpl ytsVLe3V27j7IfWb62nI+mNVfH5m+YgK4SGK5DSq8Nm1Lk0w4HXmTtrhOCogsJ2I yoqeg/XakiSdxZxhSa9/ZZsMB+D1B8siNzCj0+U0k4zYjxEA0GdSu/dYRVT62oIn vBrJ5gm+nnyRe2TUMAwz =h9hc -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

network

TYPE

Input Validation Error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Jim Jagielski, Stefan Fritsch and Niels Heinen

SOURCES

LAST UPDATE DATE

2024-12-21T19:32:24.592000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE