• Servicios
• Seguridad
• Documentacion

Vulnerabilidades en servidores web

La rama 1.3 de apache no ha tenido serias vulnerabilidades, mientras que la 2.0 sí que se ha visto afectada por varios fallos que han sido corregidos corregidos en distintas revisiones.

De la rama 1.3, la última versión disponible es la 1.3.34, que corrije:

1. SECURITY: core: If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. This has no impact on mod_proxy_http, yet affects any module which supports chunked encoding yet fails to prefer T-E: chunked over the Content-Length purported value. [Paul Querna, Joe Orton]

De la 2.0, la última versión es la 2.0.55, que solventa :

1. SECURITY: CAN-2005-2700 (cve.mitre.org) mod_ssl: Fix a security issue where "SSLVerifyClient" was not enforced in per-location context if "SSLVerifyClient optional" was configured in the vhost configuration. [Joe Orton]
2. SECURITY: CAN-2005-2491 (cve.mitre.org): Fix integer overflows in PCRE in quantifier parsing which could be triggered by a local user through use of a carefully-crafted regex in an .htaccess file. [Philip Hazel]
3. SECURITY: CAN-2005-2088 (cve.mitre.org) proxy: Correctly handle the Transfer-Encoding and Content-Length headers. Discard the request Content-Length whenever T-E: chunked is used, always passing one of either C-L or T-E: chunked whenever the request includes a request body. Resolves an entire class of proxy HTTP Request Splitting/Spoofing attacks. [William Rowe]
4. SECURITY: CAN-2005-2728 (cve.mitre.org) Fix cases where the byterange filter would buffer responses into memory. PR 29962. [Joe Orton]
5. SECURITY: CAN-2005-2088 (cve.mitre.org) core: If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. [Paul Querna, Joe Orton]
6. SECURITY: CAN-2005-1268 (cve.mitre.org) mod_ssl: Fix off-by-one overflow whilst printing CRL information at "LogLevel debug" which could be triggered if configured to use a "malicious" CRL. PR 35081. [Marc Stern <mstern csc.com>]

La rama 2.2, a pesar de ser más reciente ⁴, también contiene fallos críticos:

1. SECURITY: CVE-2005-2970 (cve.mitre.org) worker MPM: Fix a memory leak which can occur after an aborted connection in some limited circumstances. [Greg Ames]
2. SECURITY: CVE-2005-2700 (cve.mitre.org) mod_ssl: Fix a security issue where "SSLVerifyClient" was not enforced in per-location context if "SSLVerifyClient optional" was configured in the vhost configuration. [Joe Orton]

Recomendamos la revisión de fallos de las últimas versiones, disponibles en las siguientes URls para las distintas ramas:

1. Vulnerabilidades rama 1.3.x de apache
2. Vulnerabilidades rama 2.0.x de apache
3. Vulnerabilidades ramas 2.1.x y 2.2.0 de apache

Se han encontrado también fallos relacionados con PHP en las ramas 4.x y 5.x, recomendamos comprobar en el changelog de las últimas versiones si pueden afectar (rama 4.x de PHP, y rama 5.x de PHP)