Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.703325
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 3325-1 (apache2 - security update)
Summary:Several vulnerabilities have been found;in the Apache HTTPD server.;CVE-2015-3183;An HTTP request smuggling attack was possible due to a bug in;parsing of chunked requests. A malicious client could force the;server to misinterpret the request length, allowing cache poisoning;or credential hijacking if an intermediary proxy is in use.;;CVE-2015-3185A design error in the ap_some_auth_required function renders the;API unusable in apache2 2.4.x. This could lead to modules using;this API to allow access when they should otherwise not do so.;The fix backports the new ap_some_authn_required;API from 2.4.16.;This issue does not affect the oldstable distribution (wheezy).;;In addition, the updated package for the oldstable distribution (wheezy);removes a limitation of the Diffie-Hellman (DH) parameters to 1024 bits.;This limitation may potentially allow an attacker with very large;computing resources, like a nation-state, to break DH key exchange by;precomputation. The updated apache2 package also allows to configure;custom DH parameters. More information is contained in the;changelog.Debian.gz file.;These improvements were already present in the stable, testing, and;unstable distributions.
Description:Summary:
Several vulnerabilities have been found
in the Apache HTTPD server.
CVE-2015-3183
An HTTP request smuggling attack was possible due to a bug in
parsing of chunked requests. A malicious client could force the
server to misinterpret the request length, allowing cache poisoning
or credential hijacking if an intermediary proxy is in use.

CVE-2015-3185A design error in the ap_some_auth_required function renders the
API unusable in apache2 2.4.x. This could lead to modules using
this API to allow access when they should otherwise not do so.
The fix backports the new ap_some_authn_required
API from 2.4.16.
This issue does not affect the oldstable distribution (wheezy).

In addition, the updated package for the oldstable distribution (wheezy)
removes a limitation of the Diffie-Hellman (DH) parameters to 1024 bits.
This limitation may potentially allow an attacker with very large
computing resources, like a nation-state, to break DH key exchange by
precomputation. The updated apache2 package also allows to configure
custom DH parameters. More information is contained in the
changelog.Debian.gz file.
These improvements were already present in the stable, testing, and
unstable distributions.

Affected Software/OS:
apache2 on Debian Linux

Solution:
For the oldstable distribution (wheezy),
these problems have been fixed in version 2.2.22-13+deb7u5.

For the stable distribution (jessie), these problems have been fixed in
version 2.4.10-10+deb8u1.

For the testing distribution (stretch), these problems will be fixed
soon.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your apache2 packages.

CVSS Score:
5.0

CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-3183
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
BugTraq ID: 75963
http://www.securityfocus.com/bid/75963
BugTraq ID: 91787
http://www.securityfocus.com/bid/91787
Debian Security Information: DSA-3325 (Google Search)
http://www.debian.org/security/2015/dsa-3325
https://security.gentoo.org/glsa/201610-02
HPdes Security Advisory: HPSBUX03512
http://marc.info/?l=bugtraq&m=144493176821532&w=2
HPdes Security Advisory: SSRT102254
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
RedHat Security Advisories: RHSA-2015:1666
http://rhn.redhat.com/errata/RHSA-2015-1666.html
RedHat Security Advisories: RHSA-2015:1667
http://rhn.redhat.com/errata/RHSA-2015-1667.html
RedHat Security Advisories: RHSA-2015:1668
http://rhn.redhat.com/errata/RHSA-2015-1668.html
RedHat Security Advisories: RHSA-2015:2659
https://access.redhat.com/errata/RHSA-2015:2659
RedHat Security Advisories: RHSA-2015:2660
https://access.redhat.com/errata/RHSA-2015:2660
RedHat Security Advisories: RHSA-2015:2661
http://rhn.redhat.com/errata/RHSA-2015-2661.html
RedHat Security Advisories: RHSA-2016:0061
http://rhn.redhat.com/errata/RHSA-2016-0061.html
RedHat Security Advisories: RHSA-2016:0062
http://rhn.redhat.com/errata/RHSA-2016-0062.html
RedHat Security Advisories: RHSA-2016:2054
http://rhn.redhat.com/errata/RHSA-2016-2054.html
RedHat Security Advisories: RHSA-2016:2055
http://rhn.redhat.com/errata/RHSA-2016-2055.html
RedHat Security Advisories: RHSA-2016:2056
http://rhn.redhat.com/errata/RHSA-2016-2056.html
http://www.securitytracker.com/id/1032967
SuSE Security Announcement: openSUSE-SU-2015:1684 (Google Search)
http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html
http://www.ubuntu.com/usn/USN-2686-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-3185
http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
BugTraq ID: 75965
http://www.securityfocus.com/bid/75965
https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E
RedHat Security Advisories: RHSA-2016:2957
http://rhn.redhat.com/errata/RHSA-2016-2957.html
RedHat Security Advisories: RHSA-2017:2708
https://access.redhat.com/errata/RHSA-2017:2708
RedHat Security Advisories: RHSA-2017:2709
https://access.redhat.com/errata/RHSA-2017:2709
RedHat Security Advisories: RHSA-2017:2710
https://access.redhat.com/errata/RHSA-2017:2710
CopyrightCopyright (c) 2015 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.