PCI Security failure Apache 2.2.14
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
apache2 (Ubuntu) |
Invalid
|
Undecided
|
Unassigned |
Bug Description
We're running Ubuntu 10.04.3 as a server for our monitoring system and it's open to the outside so we can check the status from anywhere using our mobile devices. However, we are bringing our systems up to be PCI Compliant and the server fails PCI Security tests everytime due to vulnerabilities in Apache versions 2.2.18 and below. Currently, Lucid Server only has Apache 2.2.14 in the repos. Since Lucid is LTS, I would expect at some point this would be updated to Apache 2.2.19 since it contains the necessary security updates to bring Apache up to PCI Standards.
here's a copy of what was reported to us:
Description: vulnerable
Apache version: 2.2.14 12.27.211.
Aug 16 14:24:06 2011new
Severity: Critical Problem CVE: CVE-2010-0425 CVE-2010-0434 CVE-2010-1452 CVE-2010-1623 CVE-2010-2068 CVE-2011-0419 CVE-2011-1928 10.010new11
Impact: A remote attacker could crash the web server or execute arbitrary commands.
Background: Apache is a web server which runs on Unix, Linux, Mac OS and Windows systems. Apache web servers support chunked encoding, which is part of the HTTP protocol specification. Chunked encoding is used by a web client to send data to the server in parts, or chunks. After a chunk is received, the server indicates that it is ready to receive the next chunk, until all of the data has been received.
Resolution [http://
Vulnerability Details: Service: http Received: Server: Apache/2.2.14 (Ubuntu)
Your PCI scanning software is broken, it is scanning for software version numbers instead of looking at specific package versions. /wiki.ubuntu. com/SecurityTea m/FAQ#Versions
See: https:/
For the specific CVE numbers you've mentioned: www.ubuntu. com/usn/ usn-908- 1/ www.ubuntu. com/usn/ usn-1021- 1/ www.ubuntu. com/usn/ usn-1021- 1/ www.ubuntu. com/usn/ usn-1134- 1/ www.ubuntu. com/usn/ usn-1134- 1/
CVE-2010-0425 is a windows-specific vulnerability, it doesn't apply to Ubuntu
CVE-2010-0434 is fixed already, see http://
CVE-2010-1452 is fixed already, see http://
CVE-2010-1623 is fixed already, see http://
CVE-2010-2068 is a windows-specific vulnerability, it doesn't apply to Ubuntu
CVE-2011-0419 is fixed already, see http://
CVE-2011-1928 is fixed already, see http://