Several security vulnerabilities were discovered in Apache HTTP server, which could lead to denial of service or exposure of sensitive information. Fortunately, they have been addressed in the new version and upgrading Apache HTTP server package is strongly recommended. Canonical has also released security updates to address these vulnerabilities across multiple versions of its operating system, including Ubuntu 24.04 LTS, Ubuntu 23.10, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS.

Apache HTTP Server Vulnerabilities Fixed

CVE-2024-36387

Apache HTTP Server was found to incorrectly handle serving WebSocker protocol upgrades over HTTP/2 connection. A remote attacker can exploit this issue to crash the server, leading to denial of service.

CVE-2024-38473

The mod_proxy_module in the Apache HTTP Server incorrectly sent certain request URLs with incorrect encodings to backends. A remote attacker can use this to bypass the authentication mechanism.

CVE-2024-38474, CVE-2024-38475, CVE-2024-39573

Three Apache HTTP Server vulnerabilities were discovered where the mod_rewrite module incorrectly handled certain substitutions. Exploiting these issues could allow a remote attacker to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require the use of the new UnsafeAllow3F flag to manage unsafe substitutions.

CVE-2024-38476

It was discovered that the Apache HTTP Server incorrectly handles certain response headers. This vulnerability could be exploited by a remote attacker to obtain sensitive information, execute local scripts, or perform Server-Side Request Forgery (SSRF) attacks.

CVE-2024-38477

Another issue with the mod_proxy module, this vulnerability involves incorrect handling of certain requests, which could lead to a denial of service (server crash).

CVE-2024-39884

This vulnerability was found in how the Apache HTTP Server handles certain handlers configured via AddType. A remote attacker could potentially exploit this to obtain source code.

How to Stay Secure?

To protect your system from these vulnerabilities, it is crucial to update your Apache HTTP Server to the latest version. For users of supported Ubuntu releases, such as Ubuntu 24.04 LTS, Ubuntu 23.10, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS, Canonical has made the necessary updates available. A standard system update will implement all required changes to secure your server.

Updating your system to the latest package versions can be easily done using the apt package manager. Here’s a quick guide:

Update the package list:

$ sudo apt update

Upgrade the installed packages:

$ sudo apt upgrade

For end-of-life (EOL) systems like Ubuntu 16.04 and Ubuntu 18.04, obtaining security updates requires an Ubuntu Pro subscription. This subscription can be costly, but it provides essential security updates. Alternatively, TuxCare’s Extended Lifecycle Support offers a more affordable solution, providing vendor-grade security patches for up to an additional five years after the EOL date. This service covers the Apache package, Linux kernel, OpenSSL, glibc, OpenSSH, Python, and various other packages.

Source: USN-6885-1

The post Ubuntu Patches Several Apache HTTP Server Vulnerabilities appeared first on TuxCare.

*** This is a Security Bloggers Network syndicated blog from TuxCare authored by Rohan Timalsina. Read the original post at: https://tuxcare.com/blog/ubuntu-patches-several-apache-http-server-vulnerabilities/