SB2011103107 - Amazon Linux AMI update for httpd

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2011103107

SB2011103107 - Amazon Linux AMI update for httpd

Published: October 31, 2011

Security Bulletin ID SB2011103107
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Resource management error (CVE-ID: CVE-2011-3348)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.


2) Input validation error (CVE-ID: CVE-2011-3368)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.


Remediation

Install update from vendor's website.

References