RHSA-2014:0784 - Security Advisory

Topic

An update for the Apache HTTP Server component of Red Hat JBoss Web Server
2.0.1 that fixes two security issues and one bug is now available from the
Red Hat Customer Portal for Red Hat Enterprise Linux 5 and 6, Solaris, and
Microsoft Windows.

The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

It was found that the mod_dav module did not correctly strip leading white
space from certain elements in a parsed XML. In certain httpd
configurations that use the mod_dav module (for example when using the
mod_dav_svn module), a remote attacker could send a specially crafted DAV
request that would cause the httpd child process to crash or, possibly,
allow the attacker to execute arbitrary code with the privileges of the
"apache" user. (CVE-2013-6438)

A buffer over-read flaw was found in the httpd mod_log_config module.
In configurations where cookie logging is enabled, a remote attacker could
use this flaw to crash the httpd child process via an HTTP request with a
malformed cookie header. (CVE-2014-0098)

This update also fixes the following bug:

It was discovered that the mod_log_config module, which provides logging of
client requests, truncated cookie values at the first occurrence of an
equal sign ('=') when using the "%{abc}C" syntax in a LogFormat definition.
(ASF Bug 53104)

All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat
Customer Portal are advised to apply this update. The Apache HTTP Server
must be restarted for this update to take effect.

Solution

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files).

Affected Products

• JBoss Enterprise Web Server Text-Only Advisories x86_64

Fixes

• BZ - 1077867 - CVE-2013-6438 httpd: mod_dav denial of service via crafted DAV WRITE request
• BZ - 1077871 - CVE-2014-0098 httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS

CVEs

• CVE-2013-6438
• CVE-2014-0098

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=2.0.1
• https://issues.apache.org/bugzilla/show_bug.cgi?id=53104