Running a recent Apache web server version? You probably need to patch it. Now
(2021/10/06)
- Reference: 1633537688
- News link: https://www.theregister.co.uk/2021/10/06/apache_web_server_data_patch/
- Source link:
The Apache Software Foundation has hurried out a patch to address a pair of HTTP Web Server vulnerabilities, at least one of which is already being actively exploited.
Apache's HTTP Server is widely used, and the vulnerabilities, [1]CVE-2021-41524 and [2]CVE-2021-41773 , aren't great. The latter, a path traversal and file disclosure flaw, is particularly problematic.
The former was reported to Apache's security team on 17 September and can be exploited by an external source to DoS a server with a specially crafted request. It turned up in version 2.4.49, which was released on September 15, and the Apache crew is not aware of any exploit.
[3]
The other, a critical data leak bug, was also introduced in version 2.4.49. [4]Apache said yesterday the flaw was reported to the security team on 29 September and a patch prepared on 1 October. The fix was released, along with a fix for the other vulnerability, on 4 October in version 2.4.50.
[5]ALPACA gnaws through TLS protection to snarf cookies and steal data
[6]Update on PHP source code compromise: User database leak suspected
[7]QNAP caught napping as disclosure delay expires, critical NAS bugs revealed
[8]In Rust we trust: Shoring up Apache, ISRG ditches C, turns to wunderkind lang for new TLS crypto module
According to Apache, CVE-2021-41773 allows an attacker to "use a path traversal attack to map URLs to files outside the expected document root." If those files are not protected by "require all denied," then all manner of bad things can happen: the request for the file could succeed, source code to CGI scripts could leak, and so on.
The flaw crept in during a change made to path normalization in version 2.4.49 of the Apache HTTP Server. To be clear, both bugs are present in 2.4.49 only.
[9]
The advice, as ever, is to patch affected servers. Miscreants are already exploiting one of the holes. Given how new version 2.4.49 is, not too many systems will be running it and therefore vulnerable.
That said, there are about 113,000 potentially at-risk boxes, some of which are probably honeypots, facing the public internet right now, according to [10]Shodan . ®
Get our [11]Tech Resources
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41524
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YV4cnRSs85fib9esgpEioQAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E
[5] https://www.theregister.com/2021/06/10/alpaca_tls_protection/
[6] https://www.theregister.com/2021/04/07/update_on_php_source_code/
[7] https://www.theregister.com/2021/04/02/qnap_bug_nas/
[8] https://www.theregister.com/2021/02/02/patching_apache_rust/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV4cnRSs85fib9esgpEioQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.shodan.io/search?query=apache+2.4.49
[11] https://whitepapers.theregister.com/
Apache's HTTP Server is widely used, and the vulnerabilities, [1]CVE-2021-41524 and [2]CVE-2021-41773 , aren't great. The latter, a path traversal and file disclosure flaw, is particularly problematic.
The former was reported to Apache's security team on 17 September and can be exploited by an external source to DoS a server with a specially crafted request. It turned up in version 2.4.49, which was released on September 15, and the Apache crew is not aware of any exploit.
[3]
The other, a critical data leak bug, was also introduced in version 2.4.49. [4]Apache said yesterday the flaw was reported to the security team on 29 September and a patch prepared on 1 October. The fix was released, along with a fix for the other vulnerability, on 4 October in version 2.4.50.
[5]ALPACA gnaws through TLS protection to snarf cookies and steal data
[6]Update on PHP source code compromise: User database leak suspected
[7]QNAP caught napping as disclosure delay expires, critical NAS bugs revealed
[8]In Rust we trust: Shoring up Apache, ISRG ditches C, turns to wunderkind lang for new TLS crypto module
According to Apache, CVE-2021-41773 allows an attacker to "use a path traversal attack to map URLs to files outside the expected document root." If those files are not protected by "require all denied," then all manner of bad things can happen: the request for the file could succeed, source code to CGI scripts could leak, and so on.
The flaw crept in during a change made to path normalization in version 2.4.49 of the Apache HTTP Server. To be clear, both bugs are present in 2.4.49 only.
[9]
The advice, as ever, is to patch affected servers. Miscreants are already exploiting one of the holes. Given how new version 2.4.49 is, not too many systems will be running it and therefore vulnerable.
That said, there are about 113,000 potentially at-risk boxes, some of which are probably honeypots, facing the public internet right now, according to [10]Shodan . ®
Get our [11]Tech Resources
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41524
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YV4cnRSs85fib9esgpEioQAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E
[5] https://www.theregister.com/2021/06/10/alpaca_tls_protection/
[6] https://www.theregister.com/2021/04/07/update_on_php_source_code/
[7] https://www.theregister.com/2021/04/02/qnap_bug_nas/
[8] https://www.theregister.com/2021/02/02/patching_apache_rust/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YV4cnRSs85fib9esgpEioQAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.shodan.io/search?query=apache+2.4.49
[11] https://whitepapers.theregister.com/
Re: Let it Bleed
Anonymous Coward
Same for our internal VisualSVN Server!
Glad to see that isn't vulnerable. It's not a shadow IT installation, but its pretty far in the shade (tacitly supported by local IT on one of the few in-house servers left, maintained by an Engineering group, if corporate IT took notice, it'd go away because they're in "everything to the cloud" mode).
probably don't need to patch
Nate Amsden
Would be surprised if more than 0.01% of apache servers out there run that latest(affected) version. Ubuntu 20 for example runs 2.4.41. Can't remember the last time I felt a need to upgrade apache(as in to get some feature or specific fix for an issue I had), I mean it's done everything I need going back to what was it 1.3 version or maybe even earlier. Last time I built apache from source was probably late 90s.
Let it Bleed
Phew - our freshly updated Debian 10 based servers are still on 2.4.38.
No edgy nervous breakdowns for us.