Lucene search

K
slackwareSlackware Linux ProjectSSA-2021-280-01
HistoryOct 08, 2021 - 3:27 a.m.

[slackware-security] httpd

2021-10-0803:27:06
Slackware Linux Project
www.slackware.com
32

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.975 High

EPSS

Percentile

99.9%

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current
to fix a security issue.

Here are the details from the Slackware 14.2 ChangeLog:

patches/packages/httpd-2.4.51-i586-1_slack14.2.txz: Upgraded.
SECURITY: CVE-2021-42013: Path Traversal and Remote Code
Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete
fix of CVE-2021-41773) (cve.mitre.org)
It was found that the fix for CVE-2021-41773 in Apache HTTP
Server 2.4.50 was insufficient. An attacker could use a path
traversal attack to map URLs to files outside the directories
configured by Alias-like directives.
If files outside of these directories are not protected by the
usual default configuration “require all denied”, these requests
can succeed. If CGI scripts are also enabled for these aliased
pathes, this could allow for remote code execution.
This issue only affects Apache 2.4.49 and Apache 2.4.50 and not
earlier versions.
Credits: Reported by Juan Escobar from Dreamlab Technologies,
Fernando MuA±oz from NULL Life CTF Team, and Shungo Kumasaka
For more information, see:
https://vulners.com/cve/CVE-2021-42013
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/httpd-2.4.51-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/httpd-2.4.51-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/httpd-2.4.51-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/httpd-2.4.51-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/httpd-2.4.51-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/httpd-2.4.51-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/httpd-2.4.51-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/httpd-2.4.51-x86_64-1.txz

MD5 signatures:

Slackware 14.0 package:
3dc9af339945226035885f4896e7c443 httpd-2.4.51-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
621539c82e9f23a2b63ec4ad4fe60fa1 httpd-2.4.51-x86_64-1_slack14.0.txz

Slackware 14.1 package:
b05881b3d8d5ce4edc267c1ab6f70be1 httpd-2.4.51-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
7be7108c6acbf118df01c06632242607 httpd-2.4.51-x86_64-1_slack14.1.txz

Slackware 14.2 package:
d1d85a41387af3f18b777d000a023288 httpd-2.4.51-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
7909fd6353790b8cb3dd2d083ea7d6f3 httpd-2.4.51-x86_64-1_slack14.2.txz

Slackware -current package:
169e11d499afa90780a1d8d9c23a5a94 n/httpd-2.4.51-i586-1.txz

Slackware x86_64 -current package:
c761e7d4fbc8198a21025b804a962874 n/httpd-2.4.51-x86_64-1.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg httpd-2.4.51-i586-1_slack14.2.txz

Then, restart Apache httpd:

> /etc/rc.d/rc.httpd stop
> /etc/rc.d/rc.httpd start

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.975 High

EPSS

Percentile

99.9%