If your web-server runs on Apache, you should immediately install the latest available version of the server application to prevent hackers from taking unauthorized control over it.
Apache recently fixed multiple vulnerabilities in its web server software that could have potentially led to the execution of arbitrary code and, in specific scenarios, even could allow attackers to cause a crash and denial of service.
The flaws, tracked as CVE-2020-9490, CVE-2020-11984, CVE-2020-11993, were
uncoveredby Felix Wilhelm of Google Project Zero, and have since been addressed by the Apache Foundation in the latest version of the software (
2.4.46).
The first of the three issues involve a possible remote code execution vulnerability due to a buffer overflow with the "mod_uwsgi" module (CVE-2020-11984), potentially allowing an adversary to view, change, or delete sensitive data depending on the privileges associated with an application running on the server.
"[A] Malicious request may result in information disclosure or [remote code execution] of an existing file on the server running under a malicious process environment,"
Apache noted.
A second flaw concerns a vulnerability that's triggered when debugging is enabled in the "
mod_http2" module (CVE-2020-11993), causing logging statements to be made on the wrong connection and therefore resulting in memory corruption due to the concurrent log pool usage.
CVE-2020-9490, the most severe of the three, also resides in the HTTP/2 module and uses a
specially crafted 'Cache-Digest' headerto cause a memory corruption to lead to a crash and denial of service.
Cache Digest is part of a now-abandoned
web optimization featurethat aims to address an issue with server pushes — which allows a server to preemptively send responses to a client ahead of time — by allowing the clients to inform the server of their freshly cached contents so that bandwidth is not wasted in sending resources that are already in the client's cache.
Thus when a specially crafted value is injected into the 'Cache-Digest' header in an HTTP/2 request, it would cause a crash when the server sends a PUSH packet using the header. On unpatched servers, this issue can be resolved by turning the
HTTP/2 server pushfeature off.
Although there are currently no reports of these vulnerabilities being exploited in the wild, it's essential that the patches are applied to vulnerable systems immediately after appropriate testing as well as ensure that the application has been configured with only the required permissions so as to mitigate the impact.
Security
via https://www.AiUpNow.com
August 25, 2020 at 02:55AM by noreply@blogger.com (Ravie Lakshmanan), Khareem Sudlow
