Security update for Apache2
SUSE Security Update: Security update for Apache2
This update of apache fixes regressions and several
security problems:
*
bnc#741243, CVE-2012-0031: Fixed a scoreboard
corruption (shared mem segment) by child causes crash of
privileged parent (invalid free()) during shutdown.
*
bnc#743743,CVE-2012-0053: Fixed an issue in error
responses that could expose "httpOnly" cookies when no
custom ErrorDocument is specified for status code 400".
*
bnc#736706, the SSL configuration template suggested
weak ciphers
*
bnc#738855,CVE-2007-6750: The "mod_reqtimeout" module
was backported from Apache 2.2.21 to help mitigate the
"Slowloris" Denial of Service attack.
You need to enable the "mod_reqtimeout" module in
your existing apache configuration to make it effective,
e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2.
Security Issue references:
* CVE-2012-0031
>
* CVE-2012-0053
>
* CVE-2007-6750
>
| Announcement ID: | SUSE-SU-2012:0323-1 |
| Rating: | important |
| References: | #736706 #738855 #741243 #743743 |
| Affected Products: |
An update that solves three vulnerabilities and has one errata is now available.
Description:
This update of apache fixes regressions and several
security problems:
*
bnc#741243, CVE-2012-0031: Fixed a scoreboard
corruption (shared mem segment) by child causes crash of
privileged parent (invalid free()) during shutdown.
*
bnc#743743,CVE-2012-0053: Fixed an issue in error
responses that could expose "httpOnly" cookies when no
custom ErrorDocument is specified for status code 400".
*
bnc#736706, the SSL configuration template suggested
weak ciphers
*
bnc#738855,CVE-2007-6750: The "mod_reqtimeout" module
was backported from Apache 2.2.21 to help mitigate the
"Slowloris" Denial of Service attack.
You need to enable the "mod_reqtimeout" module in
your existing apache configuration to make it effective,
e.g. in the APACHE_MODULES line in /etc/sysconfig/apache2.
Security Issue references:
* CVE-2012-0031
* CVE-2012-0053
* CVE-2007-6750
Package List:
- SUSE Linux Enterprise Server 10 SP4 (i586 ia64 ppc s390x x86_64):
- apache2-2.2.3-16.44.1
- apache2-devel-2.2.3-16.44.1
- apache2-doc-2.2.3-16.44.1
- apache2-example-pages-2.2.3-16.44.1
- apache2-prefork-2.2.3-16.44.1
- apache2-worker-2.2.3-16.44.1
- SLE SDK 10 SP4 (i586 ia64 ppc s390x x86_64):
- apache2-2.2.3-16.44.1
- apache2-devel-2.2.3-16.44.1
- apache2-doc-2.2.3-16.44.1
- apache2-example-pages-2.2.3-16.44.1
- apache2-prefork-2.2.3-16.44.1
- apache2-worker-2.2.3-16.44.1
References:
- http://support.novell.com/security/cve/CVE-2007-6750.html
- http://support.novell.com/security/cve/CVE-2012-0031.html
- http://support.novell.com/security/cve/CVE-2012-0053.html
- https://bugzilla.novell.com/736706
- https://bugzilla.novell.com/738855
- https://bugzilla.novell.com/741243
- https://bugzilla.novell.com/743743
- http://download.suse.com/patch/finder/?keywords=1e0c99b5795cd7497ef910246faba28d