Amazon Linux AMI update for httpd24



Published: 2019-10-26
Risk Medium
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2019-10081
CVE-2019-10082
CVE-2019-10092
CVE-2019-10097
CVE-2019-10098
CVE-2019-9517
CWE-ID CWE-787
CWE-416
CWE-79
CWE-476
CWE-20
CWE-399
Exploitation vector Network
Public exploit Public exploit code for vulnerability #5 is available.
Vulnerable software
Subscribe 		Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Out-of-bounds write

EUVDB-ID: #VU20373

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-10081

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a boundary error when processing HTTP/2 requests within the mod_http2 module, configured with "H2PushResource". A remote attacker can send specially crafted HTTP/2 requests to the affected server and perform denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mod24_ssl-2.4.41-1.88.amzn1.i686
    mod24_proxy_html-2.4.41-1.88.amzn1.i686
    mod24_ldap-2.4.41-1.88.amzn1.i686
    httpd24-devel-2.4.41-1.88.amzn1.i686
    mod24_md-2.4.41-1.88.amzn1.i686
    httpd24-2.4.41-1.88.amzn1.i686
    httpd24-tools-2.4.41-1.88.amzn1.i686
    httpd24-debuginfo-2.4.41-1.88.amzn1.i686
    mod24_session-2.4.41-1.88.amzn1.i686

noarch:
    httpd24-manual-2.4.41-1.88.amzn1.noarch

src:
    httpd24-2.4.41-1.88.amzn1.src

x86_64:
    mod24_ssl-2.4.41-1.88.amzn1.x86_64
    httpd24-tools-2.4.41-1.88.amzn1.x86_64
    mod24_ldap-2.4.41-1.88.amzn1.x86_64
    mod24_session-2.4.41-1.88.amzn1.x86_64
    httpd24-2.4.41-1.88.amzn1.x86_64
    mod24_md-2.4.41-1.88.amzn1.x86_64
    httpd24-devel-2.4.41-1.88.amzn1.x86_64
    httpd24-debuginfo-2.4.41-1.88.amzn1.x86_64
    mod24_proxy_html-2.4.41-1.88.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2019-1311.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Use-after-free

EUVDB-ID: #VU20386

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-10082

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the mod_http2 when handling connection shutdown. A remote attacker can send specially crafted requests to the affected server and make the mod_http2 to read memory that was already freed.


Mitigation

Update the affected packages:

i686:
    mod24_ssl-2.4.41-1.88.amzn1.i686
    mod24_proxy_html-2.4.41-1.88.amzn1.i686
    mod24_ldap-2.4.41-1.88.amzn1.i686
    httpd24-devel-2.4.41-1.88.amzn1.i686
    mod24_md-2.4.41-1.88.amzn1.i686
    httpd24-2.4.41-1.88.amzn1.i686
    httpd24-tools-2.4.41-1.88.amzn1.i686
    httpd24-debuginfo-2.4.41-1.88.amzn1.i686
    mod24_session-2.4.41-1.88.amzn1.i686

noarch:
    httpd24-manual-2.4.41-1.88.amzn1.noarch

src:
    httpd24-2.4.41-1.88.amzn1.src

x86_64:
    mod24_ssl-2.4.41-1.88.amzn1.x86_64
    httpd24-tools-2.4.41-1.88.amzn1.x86_64
    mod24_ldap-2.4.41-1.88.amzn1.x86_64
    mod24_session-2.4.41-1.88.amzn1.x86_64
    httpd24-2.4.41-1.88.amzn1.x86_64
    mod24_md-2.4.41-1.88.amzn1.x86_64
    httpd24-devel-2.4.41-1.88.amzn1.x86_64
    httpd24-debuginfo-2.4.41-1.88.amzn1.x86_64
    mod24_proxy_html-2.4.41-1.88.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2019-1311.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Cross-site scripting

EUVDB-ID: #VU20384

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-10092

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data on the mod_proxy error page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Update the affected packages:

i686:
    mod24_ssl-2.4.41-1.88.amzn1.i686
    mod24_proxy_html-2.4.41-1.88.amzn1.i686
    mod24_ldap-2.4.41-1.88.amzn1.i686
    httpd24-devel-2.4.41-1.88.amzn1.i686
    mod24_md-2.4.41-1.88.amzn1.i686
    httpd24-2.4.41-1.88.amzn1.i686
    httpd24-tools-2.4.41-1.88.amzn1.i686
    httpd24-debuginfo-2.4.41-1.88.amzn1.i686
    mod24_session-2.4.41-1.88.amzn1.i686

noarch:
    httpd24-manual-2.4.41-1.88.amzn1.noarch

src:
    httpd24-2.4.41-1.88.amzn1.src

x86_64:
    mod24_ssl-2.4.41-1.88.amzn1.x86_64
    httpd24-tools-2.4.41-1.88.amzn1.x86_64
    mod24_ldap-2.4.41-1.88.amzn1.x86_64
    mod24_session-2.4.41-1.88.amzn1.x86_64
    httpd24-2.4.41-1.88.amzn1.x86_64
    mod24_md-2.4.41-1.88.amzn1.x86_64
    httpd24-devel-2.4.41-1.88.amzn1.x86_64
    httpd24-debuginfo-2.4.41-1.88.amzn1.x86_64
    mod24_proxy_html-2.4.41-1.88.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2019-1311.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) NULL pointer dereference

EUVDB-ID: #VU20385

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-10097

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing PROXY header within the mod_remoteip. A remote attacker that controls a trusted proxy server can send a specially crafted PROXY header,  trigger stack overflow and perform a denial of service (DoS) attack.

Mitigation

Update the affected packages:

i686:
    mod24_ssl-2.4.41-1.88.amzn1.i686
    mod24_proxy_html-2.4.41-1.88.amzn1.i686
    mod24_ldap-2.4.41-1.88.amzn1.i686
    httpd24-devel-2.4.41-1.88.amzn1.i686
    mod24_md-2.4.41-1.88.amzn1.i686
    httpd24-2.4.41-1.88.amzn1.i686
    httpd24-tools-2.4.41-1.88.amzn1.i686
    httpd24-debuginfo-2.4.41-1.88.amzn1.i686
    mod24_session-2.4.41-1.88.amzn1.i686

noarch:
    httpd24-manual-2.4.41-1.88.amzn1.noarch

src:
    httpd24-2.4.41-1.88.amzn1.src

x86_64:
    mod24_ssl-2.4.41-1.88.amzn1.x86_64
    httpd24-tools-2.4.41-1.88.amzn1.x86_64
    mod24_ldap-2.4.41-1.88.amzn1.x86_64
    mod24_session-2.4.41-1.88.amzn1.x86_64
    httpd24-2.4.41-1.88.amzn1.x86_64
    mod24_md-2.4.41-1.88.amzn1.x86_64
    httpd24-devel-2.4.41-1.88.amzn1.x86_64
    httpd24-debuginfo-2.4.41-1.88.amzn1.x86_64
    mod24_proxy_html-2.4.41-1.88.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2019-1311.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Input validation error

EUVDB-ID: #VU20374

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-10098

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to incorrect handling of encoded line break characters  within rewrite rules. A remote attacker can send a specially crafted HTTP request and potentially bypass security restrictions.

Mitigation

Update the affected packages:

i686:
    mod24_ssl-2.4.41-1.88.amzn1.i686
    mod24_proxy_html-2.4.41-1.88.amzn1.i686
    mod24_ldap-2.4.41-1.88.amzn1.i686
    httpd24-devel-2.4.41-1.88.amzn1.i686
    mod24_md-2.4.41-1.88.amzn1.i686
    httpd24-2.4.41-1.88.amzn1.i686
    httpd24-tools-2.4.41-1.88.amzn1.i686
    httpd24-debuginfo-2.4.41-1.88.amzn1.i686
    mod24_session-2.4.41-1.88.amzn1.i686

noarch:
    httpd24-manual-2.4.41-1.88.amzn1.noarch

src:
    httpd24-2.4.41-1.88.amzn1.src

x86_64:
    mod24_ssl-2.4.41-1.88.amzn1.x86_64
    httpd24-tools-2.4.41-1.88.amzn1.x86_64
    mod24_ldap-2.4.41-1.88.amzn1.x86_64
    mod24_session-2.4.41-1.88.amzn1.x86_64
    httpd24-2.4.41-1.88.amzn1.x86_64
    mod24_md-2.4.41-1.88.amzn1.x86_64
    httpd24-devel-2.4.41-1.88.amzn1.x86_64
    httpd24-debuginfo-2.4.41-1.88.amzn1.x86_64
    mod24_proxy_html-2.4.41-1.88.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2019-1311.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Resource management error

EUVDB-ID: #VU20340

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2019-9517

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect implementation of HTTP/2 protocol. A remote attacker can  open the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Mitigation

Update the affected packages:

i686:
    mod24_ssl-2.4.41-1.88.amzn1.i686
    mod24_proxy_html-2.4.41-1.88.amzn1.i686
    mod24_ldap-2.4.41-1.88.amzn1.i686
    httpd24-devel-2.4.41-1.88.amzn1.i686
    mod24_md-2.4.41-1.88.amzn1.i686
    httpd24-2.4.41-1.88.amzn1.i686
    httpd24-tools-2.4.41-1.88.amzn1.i686
    httpd24-debuginfo-2.4.41-1.88.amzn1.i686
    mod24_session-2.4.41-1.88.amzn1.i686

noarch:
    httpd24-manual-2.4.41-1.88.amzn1.noarch

src:
    httpd24-2.4.41-1.88.amzn1.src

x86_64:
    mod24_ssl-2.4.41-1.88.amzn1.x86_64
    httpd24-tools-2.4.41-1.88.amzn1.x86_64
    mod24_ldap-2.4.41-1.88.amzn1.x86_64
    mod24_session-2.4.41-1.88.amzn1.x86_64
    httpd24-2.4.41-1.88.amzn1.x86_64
    mod24_md-2.4.41-1.88.amzn1.x86_64
    httpd24-devel-2.4.41-1.88.amzn1.x86_64
    httpd24-debuginfo-2.4.41-1.88.amzn1.x86_64
    mod24_proxy_html-2.4.41-1.88.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2019-1311.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###