Amazon Linux AMI update for httpd



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2011-3348
CVE-2011-3368
CWE-ID CWE-399
CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
 Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU32851

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2011-3348

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.

Mitigation

Update the affected packages:

i686:
    httpd-devel-2.2.21-1.19.amzn1.i686
    httpd-tools-2.2.21-1.19.amzn1.i686
    httpd-2.2.21-1.19.amzn1.i686
    mod_ssl-2.2.21-1.19.amzn1.i686
    httpd-debuginfo-2.2.21-1.19.amzn1.i686

noarch:
    httpd-manual-2.2.21-1.19.amzn1.noarch

src:
    httpd-2.2.21-1.19.amzn1.src

x86_64:
    mod_ssl-2.2.21-1.19.amzn1.x86_64
    httpd-debuginfo-2.2.21-1.19.amzn1.x86_64
    httpd-tools-2.2.21-1.19.amzn1.x86_64
    httpd-devel-2.2.21-1.19.amzn1.x86_64
    httpd-2.2.21-1.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/ALAS-2011-9.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU33694

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2011-3368

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

Mitigation

Update the affected packages:

i686:
    httpd-devel-2.2.21-1.19.amzn1.i686
    httpd-tools-2.2.21-1.19.amzn1.i686
    httpd-2.2.21-1.19.amzn1.i686
    mod_ssl-2.2.21-1.19.amzn1.i686
    httpd-debuginfo-2.2.21-1.19.amzn1.i686

noarch:
    httpd-manual-2.2.21-1.19.amzn1.noarch

src:
    httpd-2.2.21-1.19.amzn1.src

x86_64:
    mod_ssl-2.2.21-1.19.amzn1.x86_64
    httpd-debuginfo-2.2.21-1.19.amzn1.x86_64
    httpd-tools-2.2.21-1.19.amzn1.x86_64
    httpd-devel-2.2.21-1.19.amzn1.x86_64
    httpd-2.2.21-1.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

https://alas.aws.amazon.com/ALAS-2011-9.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.



###SIDEBAR###