exploit the possibilities

Red Hat Security Advisory 2017-1414-01

Red Hat Security Advisory 2017-1414-01
Posted Jun 7, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1414-01 - Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2016-0736, CVE-2016-2161, CVE-2016-6304, CVE-2016-7056, CVE-2016-8610, CVE-2016-8740, CVE-2016-8743
MD5 | 848fab94797eb5aa2aa12309ab277852

Red Hat Security Advisory 2017-1414-01

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6
Advisory ID: RHSA-2017:1414-01
Product: Red Hat JBoss Core Services
Advisory URL: https://access.redhat.com/errata/RHSA-2017:1414
Issue date: 2017-06-07
CVE Names: CVE-2016-0736 CVE-2016-2161 CVE-2016-6304
CVE-2016-7056 CVE-2016-8610 CVE-2016-8740
CVE-2016-8743
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Core Services on RHEL 6.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss Core Services on RHEL 6 Server - i386, noarch, ppc64, x86_64

3. Description:

Red Hat JBoss Core Services is a set of supplementary software for Red Hat
JBoss middleware products. This software, such as Apache HTTP Server, is
common to multiple JBoss middleware products, and is packaged under Red Hat
JBoss Core Services to allow for faster distribution of updates, and for a
more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23
Service Pack 1 serves as a replacement for Red Hat JBoss Core Services
Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in
the Release Notes document linked to in the References.

Security Fix(es):

* A memory leak flaw was found in the way OpenSSL handled TLS status
request extension data during session renegotiation. A remote attacker
could cause a TLS server using OpenSSL to consume an excessive amount of
memory and, possibly, exit unexpectedly after exhausting all available
memory, if it enabled OCSP stapling support. (CVE-2016-6304)

* It was discovered that the mod_session_crypto module of httpd did not use
any mechanisms to verify integrity of the encrypted session data stored in
the user's browser. A remote attacker could use this flaw to decrypt and
modify session data using a padding oracle attack. (CVE-2016-0736)

* It was discovered that the mod_auth_digest module of httpd did not
properly check for memory allocation failures. A remote attacker could use
this flaw to cause httpd child processes to repeatedly crash if the server
used HTTP digest authentication. (CVE-2016-2161)

* A timing attack flaw was found in OpenSSL that could allow a malicious
user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056)

* A denial of service flaw was found in the way the TLS/SSL protocol
defined processing of ALERT packets during a connection handshake. A remote
attacker could use this flaw to make a TLS/SSL server consume an excessive
amount of CPU and fail to accept connections from other clients.
(CVE-2016-8610)

* It was discovered that the HTTP parser in httpd incorrectly allowed
certain characters not permitted by the HTTP protocol specification to
appear unencoded in HTTP request headers. If httpd was used in conjunction
with a proxy or backend server that interpreted those characters
differently, a remote attacker could possibly use this flaw to inject data
into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)

* A vulnerability was found in httpd's handling of the LimitRequestFields
directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker
could send crafted requests with headers larger than the server's available
memory, causing httpd to crash. (CVE-2016-8740)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304
and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610.
Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original
reporter of CVE-2016-6304.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library
must be restarted, or the system rebooted. After installing the updated
packages, the httpd daemon will be restarted automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1377600 - CVE-2016-6304 openssl: OCSP Status Request extension unbounded memory growth
1384743 - CVE-2016-8610 SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2
1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto
1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest
1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects
1412120 - CVE-2016-7056 openssl: ECDSA P-256 timing attack key recovery

6. JIRA issues fixed (https://issues.jboss.org/):

JBCS-318 - Errata for httpd 2.4.23 SP1 RHEL 6

7. Package List:

Red Hat JBoss Core Services on RHEL 6 Server:

Source:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el6.src.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el6.src.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el6.src.rpm

i386:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-debuginfo-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-devel-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-libs-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-selinux-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-tools-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-mod_ldap-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-mod_proxy_html-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el6.i686.rpm
jbcs-httpd24-mod_security-debuginfo-2.9.1-19.GA.jbcs.el6.i686.rpm
jbcs-httpd24-mod_session-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-mod_ssl-2.4.23-120.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-debuginfo-1.0.2h-13.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-devel-1.0.2h-13.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-libs-1.0.2h-13.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-perl-1.0.2h-13.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-static-1.0.2h-13.jbcs.el6.i686.rpm

noarch:
jbcs-httpd24-httpd-manual-2.4.23-120.jbcs.el6.noarch.rpm

ppc64:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-httpd-devel-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-httpd-libs-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-httpd-selinux-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-httpd-tools-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_ldap-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_proxy_html-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_security-debuginfo-2.9.1-19.GA.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_session-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_ssl-2.4.23-120.jbcs.el6.ppc64.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el6.ppc64.rpm
jbcs-httpd24-openssl-debuginfo-1.0.2h-13.jbcs.el6.ppc64.rpm
jbcs-httpd24-openssl-devel-1.0.2h-13.jbcs.el6.ppc64.rpm
jbcs-httpd24-openssl-libs-1.0.2h-13.jbcs.el6.ppc64.rpm
jbcs-httpd24-openssl-perl-1.0.2h-13.jbcs.el6.ppc64.rpm
jbcs-httpd24-openssl-static-1.0.2h-13.jbcs.el6.ppc64.rpm

x86_64:
jbcs-httpd24-httpd-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-devel-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-libs-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-selinux-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-tools-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_ldap-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_proxy_html-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_security-2.9.1-19.GA.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_security-debuginfo-2.9.1-19.GA.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_session-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_ssl-2.4.23-120.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-1.0.2h-13.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-debuginfo-1.0.2h-13.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-devel-1.0.2h-13.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-libs-1.0.2h-13.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-perl-1.0.2h-13.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-static-1.0.2h-13.jbcs.el6.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

8. References:

https://access.redhat.com/security/cve/CVE-2016-0736
https://access.redhat.com/security/cve/CVE-2016-2161
https://access.redhat.com/security/cve/CVE-2016-6304
https://access.redhat.com/security/cve/CVE-2016-7056
https://access.redhat.com/security/cve/CVE-2016-8610
https://access.redhat.com/security/cve/CVE-2016-8740
https://access.redhat.com/security/cve/CVE-2016-8743
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-core-services/

9. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZOEFRXlSAg2UNWIIRArPwAJ9m6v5fPuR/bqB0iCR7mZf0eNlupgCeOFGA
eLS32IrqnsIU/hS41jk8+F0=
=4Ffz
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    10 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close