4

We had done a PCI scan on one of our servers running Ubuntu 12.04 LTS with apache 2.2.22.

The scan reported a vulnerability in apache 2.2.22 (Apache HTTP Server Zero-Length Directory Name in LD_LIBRARY_PATH Vulnerability).The report states to upgrade the version to the latest stable release of either 2.2.23 or 2.2.24.

How do I upgrade to the 2.2.23 to fix the vulnerability or is there a patch available that can fix this and if yes can you let me know how that can be patched.

3 Answers 3

2

According to the package search for apache2 there is no package greater than 2.2.22 in the Ubuntu repos.

However if you look at the specific vulnerability it is 'just' a local exploitable vulnerability which leads unauthorized disclosure of information. So it might be acceptable to wait for a fix. More information about the vulnerability can be found at the entry CVE-2012-0883.

1
  • It's not acceptable to wait if you're trying to pass a PCI scan however.
    – Josh
    Feb 4, 2014 at 16:44
0

rmadison apache2 shows that version 2.2.22-1 is the stable version in Ubuntu 12.04. You'll have to wait for a security upgrade to be applied to the apache2 package or for it to be updated by its maintainers.

You won't be able to update to version 2.4 in any version of Ubuntu as it isn't in the repositories yet. I wouldn't count on 2.4 entering the precise repositories as 12.04 is LTS and packages as commonly used as apache2 aren't updated on a whim.

0

Ubuntu does not backport feature releases, but just security vulnerabilities if they do have impact.

This specific one is considered to be negligible, according to this page. Quoting:

jdstrand> Debian/Ubuntu packages contain 038_no_LD_LIBRARY_PATH (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276670 for more information)

So, I suggest you can now spend your time on more useful stuff. :-)

5
  • @Josh What does that have to do with the Q&A here? I think I was clear the vulnerability does not apply to Ubuntu as a result of the compile flags used for package build configuration.
    – gertvdijk
    Feb 4, 2014 at 16:47
  • @Josh Your assumption about Ubuntu not patching is false. Ubuntu backports the fixes to the shipping 2.2.22 version. See the changelog: apt-get changelog apache2. Please don't start a new discussion in comments. Instead, I'd suggest to ask a new question in a more open approach rather than repetitive complaining.
    – gertvdijk
    Feb 4, 2014 at 20:48
  • Please understand that I am not complaining... I was only trying to point out that your comment of this issue being negligible isn't totally true because it is necessary to address issues, even negligible ones, to pass a PCI scan. That being said, I do now see thanks to your comment Ubuntu backports the fixes to the shipping 2.2.22 version and the changelog that Apache version 2.2.22-1ubuntu1.4 actually does contain fixes for everything that I supposedly failed on a PCI scan. That wasn't clear to me from your answer. Thanks!
    – Josh
    Feb 4, 2014 at 21:02
  • @Josh Fair enough. For new users of Ubuntu and just reading my answer I can imagine this isn't apparent.
    – gertvdijk
    Feb 4, 2014 at 21:05
  • 1
    Sorry, I was still confused. I see now that this specific issue (CVE-2012-0883) was not fixed, it is marked negligible as you said. Other issues, like CVE-2012-3499, are fixed in backports. My apologies for adding extended discussion in comments; Once you let me know you've read this I'll delete my comments.
    – Josh
    Feb 4, 2014 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .