Bug 2947 - mod_proxy reverse proxy exposure (CVE-2011-3368)
Summary: mod_proxy reverse proxy exposure (CVE-2011-3368)
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard:
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2011-10-06 00:59 CEST by Nicolas Vigier
Modified: 2012-01-08 12:42 CET (History)
5 users (show)

See Also:
Source RPM: apache
CVE:
Status comment:


Attachments

Description Nicolas Vigier 2011-10-06 00:59:25 CEST
http://mail-archives.apache.org/mod_mbox/httpd-announce/201110.mbox/%3C20111005141541.GA7696@redhat.com%3E

patch for version 2.2.21, I don't know if it applies to our version :
http://www.apache.org/dist/httpd/patches/apply_to_2.2.21/

A workaround for users is to review and if needed update their configuration.
Comment 1 Manuel Hiebel 2011-10-06 01:42:10 CEST
Assign to dmorgan (as maintainer of apache)

Assignee: bugsquad => dmorganec

Comment 2 Manuel Hiebel 2011-11-01 00:09:34 CET
Ping ?
Comment 3 Manuel Hiebel 2011-11-18 00:03:30 CET
Ping ?
Comment 4 Manuel Hiebel 2011-12-06 01:58:47 CET
Ping ?
Comment 5 David Walser 2011-12-30 23:37:55 CET
Mandriva's patch (might be the same one):
http://svn.mandriva.com/svn/packages/cooker/apache/current/SOURCES/httpd-2.2.21-CVE-2011-3368.diff

Advisory:
http://lists.mandriva.com/security-announce/2011-10/msg00017.php

It looks like this one is valid for current Cauldron too.

CC: (none) => luigiwalser

Comment 6 D Morgan 2011-12-31 02:04:15 CET
Please test new rpm in updates_testing

Assignee: dmorganec => qa-bugs

Comment 7 David Walser 2011-12-31 17:21:25 CET
apache update works for me on i586.  I tested it by accessing a CGI.  I didn't test mod_proxy itself.
Comment 8 David Walser 2012-01-01 06:48:05 CET
D Morgan, I just found out we're missing a patch.  The patch is here:
http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html

It actually applies to another patch (patch100).

The advisory from March 31 is here:
http://lists.mandriva.com/security-announce/2011-03/msg00016.php

CC: (none) => dmorganec

Manuel Hiebel 2012-01-01 13:13:57 CET

CC: (none) => qa-bugs
Assignee: qa-bugs => dmorganec

Comment 9 D Morgan 2012-01-01 23:12:15 CET
tks, i just fixed this.

Assignee: dmorganec => qa-bugs

Comment 10 claire robinson 2012-01-03 12:40:08 CET
The following 6 packages are going to be installed:

- apache-base-2.2.17-5.6.mga1.x86_64
- apache-modules-2.2.17-5.6.mga1.x86_64
- apache-mod_dav-2.2.17-5.6.mga1.x86_64
- apache-mod_ssl-2.2.17-5.6.mga1.x86_64
- apache-mod_userdir-2.2.17-5.6.mga1.x86_64
- apache-mpm-prefork-2.2.17-5.6.mga1.x86_64


Testing complete x86_64 using phpmyadmin and zoneminder

Requires re-testing i586.
Comment 11 David Walser 2012-01-03 22:35:09 CET
apache works fine for me on i586.  I didn't test mod_proxy or mpm-itk.
Comment 12 claire robinson 2012-01-05 15:47:34 CET
Validating the update


Advisory
-----------------
This is a security update for Apache tackling 2 vulnerabilities. 

CVE-2011-3368
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. 

CVE-2011-1176
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process. 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1176
-----------------

SRPM: apache-2.2.17-5.6.mga1.src.rpm


Could sysadmin please push from core/updates_testing to core/updates

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

David Walser 2012-01-08 00:03:23 CET

Assignee: qa-bugs => sysadmin-bugs

Comment 13 claire robinson 2012-01-08 00:38:39 CET
Reassigning QA so it doesn't get lost.

David please see:-

https://wiki.mageia.org/en/QA_process_for_validating_updates#Assign

:)

Assignee: sysadmin-bugs => qa-bugs

Comment 14 Thomas Backlund 2012-01-08 12:42:33 CET
Update pushed.

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.