RHSA-2012:0128Medium

Red Hat Security Advisory: httpd security update

Published
February 13, 2012
Last Modified
November 7, 2026

🔗 CVE IDs covered (5)

CVE-2011-3607 →CVE-2011-3639 →CVE-2011-4317 →CVE-2012-0031 →CVE-2012-0053 →

📋 Description

CVE-2011-3607 — httpd: ap_pregsub Integer overflow to buffer overflow CVE-2011-3639 — httpd: http 0.9 request bypass of the reverse proxy vulnerability CVE-2011-3368 fix CVE-2011-4317 — httpd: uri scheme bypass of the reverse proxy vulnerability CVE-2011-3368 fix CVE-2012-0031 — httpd: possible crash on shutdown due to flaw in scoreboard handling CVE-2012-0053 — httpd: cookie exposure due to error responses

🎯 Affected products70

  • Red Hat Enterprise Linux Desktop (v. 6)
  • Red Hat Enterprise Linux Desktop Optional (v. 6)
  • Red Hat Enterprise Linux HPC Node (v. 6)
  • Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Enterprise Linux Workstation (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.src as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.src as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.src as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.src as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.x86_64 as a component of Red Hat Enterprise Linux HPC Node (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-0:2.2.15-15.el6_2.1.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.ppc as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.s390 as a component of Red Hat Enterprise Linux Server (v. 6)
  • httpd-debuginfo-0:2.2.15-15.el6_2.1.s390x as a component of Red Hat Enterprise Linux Server (v. 6)
  • +40 more not shown

✅ Remediation

Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 Workaround: As noted in the original reporter's advisory (see comment #5), this issue can be mitigated by using a custom ErrorDocument setting, such as: ErrorDocument 400 "Bad Request" http://httpd.apache.org/docs/2.2/mod/core.html#errordocument It should be noted that ErrorDocument setting using path or external URL does not mitigate this issue. It should also be noted that this is not an issue by itself. This can only be exploited via some other cross-site scripting (XSS) flaw found in a web application running on the server and may allow injected JavaScript to gain access to HttpOnly cookies, if the application uses this protection for its cookies.

🔗 References (9)