[월:] 2017년 06월

USN-3340-1: Apache HTTP Server vulnerabilities Ubuntu Security Notice USN-3340-1 26th June, 2017 apache2 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in Apache HTTP Server. Software description apache2 – Apache HTTP server Details Emmanuel Dreyfus discovered that third-party modules using theap_get_basic_auth_pw() function outside of the authentication phase maylead to authentication requirements being bypassed. This update adds a newap_get_basic_auth_components() function for use by third-party modules.(CVE-2017-3167) Vasileios Panopoulos discovered that the Apache mod_ssl module may crashwhen third-party modules call ap_hook_process_connection() during an HTTPrequest to an HTTPS port. (CVE-2017-3169) Javier Jiménez discovered that the Apache HTTP Server incorrectly handledparsing certain requests. A remote attacker could possibly use this issueto cause the Apache HTTP Server to crash, resulting in a denial of service.(CVE-2017-7668) ChenQin [ more… ]