Avis du CERT RENATER

Par défaut, cette page vous affichera les derniers messages envoyés par le CERT RENATER à la communauté. Vous pouvez affiner par année ou par type de message. Si aucun critère n'est précisé, seuls les derniers messages sont affichés
Date : Mon, 16 Feb 2009 16:58:53 +0100
Type : VULN
Sujet : CERT-Renater : 2009/VULN050 (HP: HP-UX Running Apache Web Server Suite Remote vulnerabilities)
====================================================================                                   CERT-Renater

                        Note d'Information No. 2009/VULN050
_____________________________________________________________________

DATE                      : 16/02/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : HP-UX Running Apache Web Server Suite.

======================================================================

SUPPORT COMMUNICATION - SECURITY BULLETIN_

Document ID: c01650939
Version: 1

HPSBUX02401 SSRT090005 rev.2 - HP-UX Running Apache Web Server Suite,
Remote Denial of Service (DoS), Cross-site Scripting (XSS), Execution of
Arbitrary Code, Cross-Site Request Forgery (CSRF)

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2009-02-02
Last Updated: 2009-02-12

Potential Security Impact: Remote Denial of Service (DoS), cross-site
scripting (XSS), execution of arbitrary code, cross-site request
forgery (CSRF)

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP-UX running
Apache-based Web Server or Tomcat-based Servelet Engine. The vulnerabilities
could be exploited remotely to cause a Denial of Service (DoS), cross-site
scripting (XSS), execution of arbitrary code, or cross-site request forgery
(CSRF). Apache-based Web Server and Tomcat-based Servelet Engine are
contained in the Apache Web Server Suite.

References: CVE-2007-6420, CVE-2008-1232, CVE-2008-1947, CVE-2008-2364,
CVE-2008-2370, CVE-2008-2938, CVE-2008-2939, CVE-2008-3658

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.23 and B.11.31 running Apache-based Web Server v2.2.8.01.01
or v2.0.59.07.02 or earlier or Tomcat-based Servelet Engine v5.5.27.01.01
or earlier
HP-UX B.11.11 running Apache-based Web Server v2.0.59.07.02 or earlier

BACKGROUND

CVSS 2.0 Base Metrics
===============================================
Reference                         Base Vector               Base Score
CVE-2007-6420     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-1232     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-1947     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-2364     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      5.0
CVE-2008-2370     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      5.0
CVE-2008-2938     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-2939     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      4.3
CVE-2008-3658     (AV:N/AC:M/Au:N/C:N/I:P/A:N)      7.5
===============================================
Information on CVSS is documented in HP Customer Notice: HPSN-2008-002.

RESOLUTION

HP has provided the following upgrades to resolve these vulnerabilities.
The upgrades are available from the following location:

URL: http://software.hp.com

Note: HP-UX Web Server Suite v3.02 contains HP-UX Apache-based Web
Server v2.2.8.01.02 and HP-UX Tomcat-based Servlet Engine 5.5.27.01.01
Note: HP-UX Web Server Suite v2.22 contains HP-UX Apache-based Web
Server v2.0.59.07.03 and HP-UX Tomcat-based Servlet Engine 5.5.27.01.01

Web Server Suite Version
 HP-UX Release  Apache Depot name
==============================================
Web Server Suite Version - Web Server v.3.02
 B.11.11 PA-32                    HPUXWSATW-B302-32.depot
 B.11.23 and B.11.31 PA-32   HPUXWSATW-B302-32.depot
 B.11.23 and B.11.31 IA-64    HPUXWSATW-B302-64.depot

Web Server Suite Version - Web Server v.2.22
 B.11.11 PA-32  HPUXWSATW-B222-1111.depot
 B.11.23 PA-32  HPUXWSATW-B222-1123-32.depot
 B.11.23 IA-64   HPUXWSATW-B222-1123-64.depot
 B.11.31 IA-32   HPUXWSATW-B222-1131-32.depot
 B.11.31 IA-64   HPUXWSATW-B222-1131-64.depot
===============================================

MANUAL ACTIONS: Yes - Update

Install Apache-based Web Server or Tomcat-based Servelet Engine from the
Apache Web Server Suite v2.22 or v3.02 or subsequent

PRODUCT SPECIFIC INFORMATION

HP-UX Software Assistant: HP-UX Software Assistant is an enhanced
application that replaces HP-UX Security Patch Check. It analyzes
all Security Bulletins issued by HP and lists recommended actions
that may apply to a specific HP-UX system. It can also download
patches and create a depot automatically. For more information see:
https://www.hp.com/go/swa

The following text is for use by the HP-UX Software Assistant.

AFFECTED VERSIONS

For Web Server v.3.02
HP-UX B.11.11
==================
hpuxwsAPACHE.APACHE
hpuxwsAPACHE.APACHE2
hpuxwsAPACHE.AUTH_LDAP
hpuxwsAPACHE.AUTH_LDAP2
hpuxwsAPACHE.MOD_JK
hpuxwsAPACHE.MOD_JK2
hpuxwsAPACHE.MOD_PERL
hpuxwsAPACHE.MOD_PERL2
hpuxwsAPACHE.PHP
hpuxwsAPACHE.PHP2
hpuxwsAPACHE.WEBPROXY
hpuxwsTOMCAT.TOMCAT
hpuxwsWEBMIN.WEBMIN

action: install revision B.2.2.8.01.02 or subsequent
URL: http://software.hp.com

HP-UX B.11.23
==================
hpuxws22APCH32.APACHE
hpuxws22APCH32.APACHE2
hpuxws22APCH32.AUTH_LDAP
hpuxws22APCH32.AUTH_LDAP2
hpuxws22APCH32.MOD_JK
hpuxws22APCH32.MOD_JK2
hpuxws22APCH32.MOD_PERL
hpuxws22APCH32.MOD_PERL2
hpuxws22APCH32.PHP
hpuxws22APCH32.PHP2
hpuxws22APCH32.WEBPROXY
hpuxws22APCH32.WEBPROXY2
hpuxws22TOMCAT.TOMCAT
hpuxws22WEBMIN.WEBMIN

action: install revision B.2.2.8.01.02 or subsequent
URL: http://software.hp.com

HP-UX B.11.31
==================
hpuxws22APACHE.APACHE
hpuxws22APACHE.APACHE2
hpuxws22APACHE.AUTH_LDAP
hpuxws22APACHE.AUTH_LDAP2
hpuxws22APACHE.MOD_JK
hpuxws22APACHE.MOD_JK2
hpuxws22APACHE.MOD_PERL
hpuxws22APACHE.MOD_PERL2
hpuxws22APACHE.PHP
hpuxws22APACHE.PHP2
hpuxws22APACHE.WEBPROXY
hpuxws22APACHE.WEBPROXY2
hpuxws22TOMCAT.TOMCAT
hpuxws22WEBMIN.WEBMIN

action: install revision B.2.2.8.01.02 or subsequent
URL: http://software.hp.com


Web Server v.2.22
HP-UX B.11.11
==================
hpuxwsAPACHE.APACHE
hpuxwsAPACHE.APACHE2
hpuxwsAPACHE.AUTH_LDAP
hpuxwsAPACHE.AUTH_LDAP2
hpuxwsAPACHE.MOD_JK
hpuxwsAPACHE.MOD_JK2
hpuxwsAPACHE.MOD_PERL
hpuxwsAPACHE.MOD_PERL2
hpuxwsAPACHE.PHP
hpuxwsAPACHE.PHP2
hpuxwsAPACHE.WEBPROXY
hpuxwsTOMCAT.TOMCAT
hpuxwsWEBMIN.WEBMIN
action: install revision B.2.0.59.07.03 or subsequent
URL: http://software.hp.com

HP-UX B.11.23
==================
hpuxwsAPCH32.APACHE
hpuxwsAPCH32.APACHE2
hpuxwsAPCH32.AUTH_LDAP
hpuxwsAPCH32.AUTH_LDAP2
hpuxwsAPCH32.MOD_JK
hpuxwsAPCH32.MOD_JK2
hpuxwsAPCH32.MOD_PERL
hpuxwsAPCH32.MOD_PERL2
hpuxwsAPCH32.PHP
hpuxwsAPCH32 .PHP2
hpuxwsAPCH32.WEBPROXY
hpuxwsTOMCAT.TOMCAT
hpuxwsWEBMIN.HPDOCS
hpuxwsWEBMIN.WEBMIN
action: install revision B.2.0.59.07.03 or subsequent
URL: http://software.hp.com

HP-UX B.11.31
==================
hpuxwsAPCH32.APACHE
hpuxwsAPCH32.APACHE2
hpuxwsAPCH32.AUTH_LDAP
hpuxwsAPCH32.AUTH_LDAP2
hpuxwsAPCH32.MOD_JK
hpuxwsAPCH32.MOD_JK2
hpuxwsAPCH32.MOD_PERL
hpuxwsAPCH32.MOD_PERL2
hpuxwsAPCH32.PHP
hpuxwsAPCH32.PHP2
hpuxwsAPCH32.WEBPROXY
hpuxwsTOMCAT.TOMCAT
hpuxwsWEBMIN.HPDOCS
hpuxwsWEBMIN.WEBMIN
action: install revision B.2.0.59.07.03 or subsequent
URL: http://software.hp.com

END AFFECTED VERSIONS

HISTORY
Version:1 (rev.1) 2 February 2009 Initial release
Version:2 (rev.2) 12 February 2009 Corrected Affected Versions, clarified
Resolution table.

Third Party Security Patches: Third party security patches that are to be
installed on systems running HP software products should be applied in
accordance with the customer's patch management policy.


Support: For further information, contact normal HP Services support channel.

Report: To report a potential security vulnerability with any HP
supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being
communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
  To: security-alert@hp.com
  Subject: get key

Subscribe: To initiate a subscription to receive future HP Security
Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
  - check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
  - verify your operating system selections are checked and save.


To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit
Profile to update appropriate sections.


To review previously published Security Bulletins visit:
http://www.itrc.hp.com/service/cki/secBullArchive.do


* The Software Product Category that this Security Bulletin relates to is
represented by the 5th and 6th characters of the Bulletin number in the
title:

GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault

System management and security procedures must be reviewed frequently to
maintain system integrity. HP is continually reviewing and enhancing the
security features of software products to provide customers with current
secure solutions.


"HP is broadly distributing this Security Bulletin in order to bring to the
attention of users of the affected HP products the important security
information contained in this Bulletin. HP recommends that all users
determine the applicability of this information to their individual
situations and take appropriate action. HP does not warrant that this
information is necessarily accurate or complete for all user situations
and, consequently, HP will not be responsible for any damages resulting
from user's use or disregard of the information provided in this Bulletin.
To the extent permitted by law, HP disclaims all warranties, either express
or implied, including the warranties of merchantability and fitness for a
particular purpose, title and non-infringement."

©Copyright 2009 Hewlett-Packard Development Company, L.P.

Hewlett-Packard Company shall not be liable for technical or editorial errors
or omissions contained herein. The information provided is provided "as is"
without warranty of any kind. To the extent permitted by law, neither HP or
its affiliates, subcontractors or suppliers will be liable for incidental,
special or consequential damages including downtime cost; lost profits;
damages relating to the procurement of substitute products or services; or
damages for loss of data, or software restoration. The information in this
document is subject to change without notice. Hewlett-Packard Company and
the names of Hewlett-Packard products referenced herein are trademarks of
Hewlett-Packard Company in the United States and other countries. Other
product and company names mentioned herein may be trademarks of their
respective owners.

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================