==========================================================Ubuntu Security Notice USN-990-2         September 21, 2010
apache2 vulnerability
CVE-2009-3555
==========================================================
A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.04
Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  apache2-common                  2.0.55-4ubuntu2.11

Ubuntu 8.04 LTS:
  apache2.2-common                2.2.8-1ubuntu0.18

Ubuntu 9.04:
  apache2.2-common                2.2.11-2ubuntu2.7

Ubuntu 9.10:
  apache2.2-common                2.2.12-1ubuntu2.3

Ubuntu 10.04 LTS:
  apache2.2-common                2.2.14-5ubuntu8.2

In general, a standard system update will make all the necessary changes.

Details follow:

USN-860-1 introduced a partial workaround to Apache that disabled client
initiated TLS renegotiation in order to mitigate CVE-2009-3555. USN-990-1
introduced the new RFC5746 renegotiation extension in openssl, and
completely resolves the issue.

After updating openssl, an Apache server will allow both patched and
unpatched web browsers to connect, but unpatched browsers will not be able
to renegotiate. This update introduces the new SSLInsecureRenegotiation
directive for Apache that may be used to re-enable insecure renegotiations
with unpatched web browsers. For more information, please refer to:
https://httpd.apache.org/docs/2.2/mod/mod_ssl.html

Original advisory details:

 Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3
 protocols. If an attacker could perform a man in the middle attack at the
 start of a TLS connection, the attacker could inject arbitrary content at
 the beginning of the user's session. This update adds backported support
 for the new RFC5746 renegotiation extension and will use it when both the
 client and the server support it.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

          Size/MD5:   134052 86e4030d5d0a07c722a2af51df291a19
          Size/MD5:     1183 99ab703a9b5635ad8e1d9557b9fe5e4e
          Size/MD5:  6092031 45e32c9432a8e3cf4227f5af91b03622

  Architecture independent packages:

          Size/MD5:  2126176 65b28d275c8e70558d8ed77bfcef265e

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   834986 610535f67dc77d446423e9cc2408d21e
          Size/MD5:   229802 14ea62918280ce5f464ecedab9bd79b0
          Size/MD5:   224906 1578725d767b5fe9cb6b45ca41d1292e
          Size/MD5:   229384 b8f6d54777dbc86b2a5d6c4d2d7cc573
          Size/MD5:   173130 def232883ce71e08f0e2b11cfd27f5b7
          Size/MD5:   173912 08da2084c359fc7b2968432f41234e23
          Size/MD5:    95722 94484f5bfd67cc83086f7a921a77caed
          Size/MD5:    37768 f486d5e84b1907123c60d572aa7e90f2
          Size/MD5:   287306 7a907e49b019763f8149a3beb203876c
          Size/MD5:   145894 88fbebdffeb19fdbe81fe570166d73a1

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   788252 8d2b5d1f24c13e241d56fbd1ae81ff81
          Size/MD5:   204368 327dbcf36dc28bc9135c108237b1f502
          Size/MD5:   200298 58c12fa82ecf7447d77834d56f917ef3
          Size/MD5:   203844 d6f74b3551fe34434b81e26a149e4ae0
          Size/MD5:   173156 ccb5791809b19033688165a9ef0d81e6
          Size/MD5:   173924 999e1a48fdfbaf16f7bdb2d29d0ea0fc
          Size/MD5:    93640 2b3d1a6cddfaec3349b72efb5504166f
          Size/MD5:    37762 898b5d95105c199416a75cd3146c6c1b
          Size/MD5:   263308 42f340586a0360a8d923231644090cdf
          Size/MD5:   133780 fba34593386d78231b33824f328f5654

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   861116 6a6d5d616a52c907ba9203ce711355aa
          Size/MD5:   221784 297764dcac720f85348c85c2ef32a0d2
          Size/MD5:   217424 9afb62c85bcaad3db853bb7b7ebee607
          Size/MD5:   221254 9f05d5933ee0236f431a226842bf86c0
          Size/MD5:   173152 187839a4b4347c81fe5c630be07f0b3b
          Size/MD5:   173928 98b0f235f0469e5319728049367ba8a4
          Size/MD5:   105440 d6544dafd34838af96690f14c540fde3
          Size/MD5:    37770 e91ef9ad15dc3dd59d251cad5ee5ef13
          Size/MD5:   282892 13408f668b7993a6f4ec723f8cdd6bbb
          Size/MD5:   142978 e25da876441b97ac3da8272b3d49d381

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   805832 04e58a008ae3f3675a325ee2932bb253
          Size/MD5:   211912 15498a7c53b8f260dc4bb6a86bfe3d53
          Size/MD5:   207632 c0daf011cf3fada9c222142c6ffcd044
          Size/MD5:   211300 b06bb4a8f7f16378de0a21b368d3d622
          Size/MD5:   173168 ee6150a2e2c4a8221ee89c31e6177522
          Size/MD5:   173944 858f3c03cfdb0cb4ec0611ee8542671f
          Size/MD5:    94782 743ee202b5c0bebf4bdc459313552d81
          Size/MD5:    37770 802c97dff1bff907d5794b256add1e6b
          Size/MD5:   269346 24c0a57f4ad915ea8f6e094f243a9506
          Size/MD5:   131734 194d74424d27b2997c1ec72257f573c1

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

          Size/MD5:   146865 97f3b7079faf574f890681db77c762f2
          Size/MD5:     1406 399d2b9f9909282c486655549dc0d52b
          Size/MD5:  6125771 39a755eb0f584c279336387b321e3dfc

  Architecture independent packages:

          Size/MD5:  1929538 14e05937748058927c2037df3eb502c7
          Size/MD5:    73466 6ca3b132a45f4ce59171ab7f186594df
          Size/MD5:  6261582 4f1116c99f0f65ce4997a28085fa7431
          Size/MD5:    46348 98166d89408a56e09ebd4a83b83ed79c

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   253644 23f9caddb5ffe5026a558b8d572967ef
          Size/MD5:   249242 953b054df0e4dab7264eba0bd6007b59
          Size/MD5:   253048 3f4d54d5a32c915f3f151b51bae01c13
          Size/MD5:   206156 901fcdafafdb3480cf1fab5cf73af73b
          Size/MD5:   206922 6a86fc862877947519ae0fe215841385
          Size/MD5:   142242 f0b1891fc7b07c8235a40e2df3fbabb0
          Size/MD5:   804806 52c57c3584842ef918c0f37c2ce6d736

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   236606 c547fb8c061846b2f755704787448747
          Size/MD5:   232128 6fc2670a98d40c1bfa90991186228811
          Size/MD5:   235858 32e129c73e49a2e39844645dd50d04f5
          Size/MD5:   206142 cdd55808ce850d9d0ec223ed092fe426
          Size/MD5:   206910 b736a272e10fe68cb64946b508efd74c
          Size/MD5:   141202 4254d6b5ead42cedd02320bf6ddb2876
          Size/MD5:   756332 5bd40900c8939b451e8fcbed2da263f1

  lpia architecture (Low Power Intel Architecture):

          Size/MD5:   236164 9272f138e98d34b0d4019a0830e79b36
          Size/MD5:   231778 1e5f9950471fd4f778ff271d8488b60a
          Size/MD5:   235304 e8eddedf92d24b378f38bf61fa0f2cd6
          Size/MD5:   206156 467bcd1937490b798b49630c65551e60
          Size/MD5:   206926 75b6f2f47aed68fc703918b00e04f482
          Size/MD5:   141778 fd353dd7829e5876517339676b1ee873
          Size/MD5:   750676 598bc9e3e5a1b7938b4ad34e4cc04c67

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   254686 29d669072dca90bbdcf11439614ee23c
          Size/MD5:   250142 643655823b5fbd3ec33b50d7a30334cf
          Size/MD5:   254248 a6afd90ee57a63e87867fe1dfb1a9cb0
          Size/MD5:   206156 552e1373699931b091adfa28bfb3a193
          Size/MD5:   206928 eedb87366079396813a5058dd19e3a88
          Size/MD5:   158934 95c4cdcc76c0300cf6e9585b5a64b167
          Size/MD5:   907014 c64dae2099b5120197a8ffa7d4d41dc4

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   237956 525845937495f123e08dff554fa599af
          Size/MD5:   233702 13eb704a427e3dc2eea16c6831ee4c32
          Size/MD5:   237124 22a389d42cd3512386780cf6bb87f8dc
          Size/MD5:   206150 1cb75e631967a8edbf17c8959e8faf37
          Size/MD5:   206920 731f15c841b3f979146c59968cea0267
          Size/MD5:   144372 930e3abcb2ca207b0a801d1e7b2c9053
          Size/MD5:   766240 3cedd97a31291d23dd464bf501363af3

Updated packages for Ubuntu 9.04:

  Source archives:

          Size/MD5:   145104 db565a9a5297a1a306fd7a45932d702b
          Size/MD5:     1820 1cd768993ff45ac014733aa7cf95155c
          Size/MD5:  6806786 03e0a99a5de0f3f568a0087fb9993af9

  Architecture independent packages:

          Size/MD5:  2219258 b055c44bbf2e035fcaf126abd0b76fb2
          Size/MD5:    46916 cfc7b7ee2b9679700967d6228a9568c9
          Size/MD5:  6948950 e239e56fdd85126bcdd69e85b950f051

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   259324 1d0e10d402f67ca36a54c1c911a69006
          Size/MD5:   253506 a7c00fd853a29cf74da6ac9a5e9da3c3
          Size/MD5:   258706 91a66a6fadfb7d2c295a6e70ac5d03de
          Size/MD5:   213586 33e272b7355cca5159964c8b71155ad1
          Size/MD5:   214554 8bca44b947f2323b6b94382d846a4abb
          Size/MD5:   151436 6a5b923eba61bfb2797396f10938b16c
          Size/MD5:   827658 654f756c26233a94727f95df91280ca7
          Size/MD5:    88100 f7db8d90f3178aaaf9783ab0867dfe1a
          Size/MD5:    86432 220d6470ff6c1d03e35c260b34246742

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   245792 8a841b19de4b298d41298b581ef94738
          Size/MD5:   240344 17444c867fa3acb12e3468c1c34c01ba
          Size/MD5:   245228 df223029f06daab11c4d58c6f540ef1f
          Size/MD5:   213602 0f9f83fabfb1b3f63e23c8ae0adb12cc
          Size/MD5:   214570 9ca8a8f9b8169ad9ec352d66e757a046
          Size/MD5:   150344 4f5c23369c9c3e1ba13ddc5692916c38
          Size/MD5:   784886 ba51bfa801be73a09b02dcb3cab26241
          Size/MD5:    87466 cd964b4442e0dcbba54f9a0b7ec6fc3d
          Size/MD5:    85878 f77caa709cd21efa2a85e86ef9ff81cc

  lpia architecture (Low Power Intel Architecture):

          Size/MD5:   242698 df55b4d55e2b301f44d090028f15cb98
          Size/MD5:   237198 8da840e3c848a331577fa9d833842c87
          Size/MD5:   242086 bd2880092939682f4dc22c1c6671176c
          Size/MD5:   213600 795a7ae2ee3105f40bbc195f320a0fbf
          Size/MD5:   214572 b778126593e0fed9c83e706c1a09f39b
          Size/MD5:   150058 bf29eee7c1d54eb1ead38b804731e1b9
          Size/MD5:   774190 89770cf91ed09e402b56e5498f48c81c
          Size/MD5:    87416 fd45b5d764c395837ed9a3b0e58f0ecb
          Size/MD5:    85836 86b01255d8a633d59192a9feb559e158

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   265780 f114a597519a9d572cffa39296237bc2
          Size/MD5:   260776 a693ebd72a026871338e3aa8b6a527c2
          Size/MD5:   265424 b26fa086b61080cfffb6366953c6fb0b
          Size/MD5:   213602 e0ded14891fd23424f31960d93eb8ee0
          Size/MD5:   214574 a91ec98b251e1cbdda5bc9b172b9fc17
          Size/MD5:   164756 7319d899ce6d4531c9500204897f50ec
          Size/MD5:   933132 6b43c787eca540a18f3fb94d577d76cd
          Size/MD5:    88158 6468347a2c09d7a27575dc2b485389b7
          Size/MD5:    86436 d6d6390d7efa2710bcc4b65c34737d03

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   251090 6df99897e7db3d6eb31ea0ade1cbdaea
          Size/MD5:   245394 88215d008af2f6f3695b7f8a73dceee6
          Size/MD5:   250408 7d4e6592d08cce5d58929990ef2f7dc7
          Size/MD5:   213604 34163cecc4945e43096956cec44d3e26
          Size/MD5:   214570 d53eb43ac5fd6ed8fe742ee1a15ca8d9
          Size/MD5:   154594 0839be06a5fbe741ca3cc1240dcfe4f8
          Size/MD5:   789836 f718d0c11c7e4df0515d9481fe4be506
          Size/MD5:    87662 6fb7b012347fb516d184559fc8d240b2
          Size/MD5:    86024 0877fc6ca6c05a447beadabe047f29d1

Updated packages for Ubuntu 9.10:

  Source archives:

          Size/MD5:   188060 850605ce03d4489659ce1cb2cc0abc68
          Size/MD5:     1913 8d36ecddde480b75fb16706fe82990e1
          Size/MD5:  6678149 17f017b571f88aa60abebfe2945d7caf

  Architecture independent packages:

          Size/MD5:  2247010 5fa9130715ede82d32f3e8a348604075
          Size/MD5:     2348 9674046be587c64c4556f48a90ecaea6
          Size/MD5:     2382 b695def67e1cbbbfe1fd33fa97c96345
          Size/MD5:     2320 4645c0748419a66f1b5721be7d2b3197
          Size/MD5:   285380 23896ffd82544ffcdddef03d093018e3
          Size/MD5:     1428 89f8b2b78403e63cb95bb3822f668338
          Size/MD5:     2378 a80e5beda7d56dc0d930cd5f995e2eba

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   137078 53d4aec4b09109faa3f70a08dcfcefaf
          Size/MD5:   138180 9f3b6db71330a8283174ed08351113d8
          Size/MD5:   156942 4f09279ba2394c9d0b6457d86b03e3d7
          Size/MD5:  1400178 676c22d2d96b9bdba3b87f7d48864180
          Size/MD5:    92792 fb350714ee3bdc6234dc486b218ab75a
          Size/MD5:    91166 2f9bf5279b4014e327a969c935fabe0e

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   137102 77dba9a047e7bfc795658fbdf1f373b9
          Size/MD5:   138200 f99471e2347213e15794c3c3cddc2a18
          Size/MD5:   155488 6ee483e52e9e556effd84bf7b41640a7
          Size/MD5:  1309694 f92e2be5d56ae59bfe26f20fd6f7ecc2
          Size/MD5:    92182 75bbbffacaa541e0046bca6233c1c88e
          Size/MD5:    90612 3ed6196a120c65f6c8438914bce3f9af

  lpia architecture (Low Power Intel Architecture):

          Size/MD5:   137100 621e4aa3e57d81b016ea76347fa4ed86
          Size/MD5:   138202 e36e6db5508c8134d9e6999e5d80fb8d
          Size/MD5:   155398 cbad72b7d930b21255392bb549f03737
          Size/MD5:  1291102 f940d7c307e24e8d28eedf954838dafd
          Size/MD5:    92132 9e7c2ede66e695ab1362512a3c1ee827
          Size/MD5:    90614 98e1b90804cbd553dd201ad28f329430

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   137106 bd359b9a9363a81aa98655c43f1478b4
          Size/MD5:   138206 c798a77072e6634e462f1cdf3dd8b43f
          Size/MD5:   161340 875392a41fe389a1fc7eb3219de8994c
          Size/MD5:  1390682 6dee1cd49ea2fd42792adbf7d4ca1429
          Size/MD5:    92702 35649519a902f404ce2177d4d6a39256
          Size/MD5:    91068 27a790c732e9972a9ddb38efd8382be2

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   137104 cacf001abead60f0bf6bb5b4bc4ae3f8
          Size/MD5:   138202 8c2c89d48728544e02d1d8c9b8c151bd
          Size/MD5:   159784 210a6ab1994c1cd33ef3faba4ba1ef6d
          Size/MD5:  1298528 307f7a890def6607c771ed81e97d6786
          Size/MD5:    92470 99b248317f322925fa0177f1cab30193
          Size/MD5:    90846 855bfc344be95c2e2518eeb24ac26bd1

Updated packages for Ubuntu 10.04:

  Source archives:

          Size/MD5:   212134 3c177f451934f9cd6654a017f7131c9b
          Size/MD5:     2057 7372de2308c11c5449ff2fa531635871
          Size/MD5:  6684081 2c1e3c7ba00bcaa0163da7b3e66aaa1e

  Architecture independent packages:

          Size/MD5:  2257438 068a77e3441fdceedc1afc267011bf38

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:     2400 48e38cc487c5abcb64a529bbe1d47971
          Size/MD5:     2426 7f880b5588cdd0adea12a3649612d740
          Size/MD5:     2374 175d74a10131457005ff635f4ba49c97
          Size/MD5:   136260 d2318afcb9b2bfd26e46f4895f1fbd37
          Size/MD5:   137306 3347faad5f0a2f781480a555a25c9a59
          Size/MD5:   160896 8b101bf3b78dc9f16402cdbc65e5355f
          Size/MD5:  2730164 f6f41d6e25d315dc97451b39e3a309c4
          Size/MD5:   289774 245583d23128c0f6be0343146b38b72e
          Size/MD5:     1486 0c652fcedc25c59e48faec9fa5da816d
          Size/MD5:     2424 a8dfc23cc147f5d5c982309ee0665239
          Size/MD5:    96688 908d970263346097de7a052296fa6be9
          Size/MD5:    95018 ff323d16c8ecc35474d1476aeece0147

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:     2392 14bab2ebfb53ff37da5286ebbf79c8df
          Size/MD5:     2428 63d0e6069f2009c0e0a8170a6e6318f6
          Size/MD5:     2366 a7c91b2d9f5700e116412c496431d2a5
          Size/MD5:   136274 2785281078d3555724603ec98ffdce86
          Size/MD5:   137318 539ad22318c9bfcebd764fef065a166f
          Size/MD5:   159454 c4c67485f2750a64c846f6f07f8b51bb
          Size/MD5:  2622180 26fdf112437b13660e13b973ee522916
          Size/MD5:   289774 94cd4b22df3c5beb27c1c3ced19d732f
          Size/MD5:     1484 9d28b322928df90cd85c5b93757e2381
          Size/MD5:     2424 420faa39ba08d84f74c9599592904392
          Size/MD5:    96034 c525bf0f0dfb891246f63a4b900516be
          Size/MD5:    94468 c7cd6dbb03a2da94126bdc010a2e0954

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:     2402 b4022c68a3d5aaba548fbe82648676aa
          Size/MD5:     2434 989498ce049fcb82338b5661786f23d6
          Size/MD5:     2380 4fa9d61c25a2161136c657ba7ea11666
          Size/MD5:   136292 b44ed701f61489c7959058d1ab3080e5
          Size/MD5:   137332 91c2a8a81435dad521f76208a06f6f0b
          Size/MD5:   165752 ac0f1989749c0664c15474c2473d3f11
          Size/MD5:  2765172 632b25fab8e3a964479a1d65904f085f
          Size/MD5:   289808 9043e5ac2d9b48f162b101b06f7cdf0b
          Size/MD5:     1492 d8eec2abe88d0fd1c29bb939f424a769
          Size/MD5:     2428 a3b8ca7cdd7be3b81a1220f8b107f2a7
          Size/MD5:    96602 703947ce7bd754a87aab78f781c09790
          Size/MD5:    94926 6f016d6173305612ab55d75ac5250e21

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:     2398 2730e4118d859da0779dba18084eaf30
          Size/MD5:     2430 44b38809d4053bcc55f50f6c7cfa4b3c
          Size/MD5:     2372 a64eeee425b210106132ce4172bfb4a4
          Size/MD5:   136272 a8ce66227998b82d2b65df7159101a69
          Size/MD5:   137314 6ae029f5d69711cf89a1caf8baaa1400
          Size/MD5:   165720 64ad47568add781287d794c19b74967b
          Size/MD5:  2592876 3371ba1ea3f326e735cf53248ffb7615
          Size/MD5:   289788 e7e4c6c55df10cf3f9619165c85e03a9
          Size/MD5:     1488 91a5fac3d7ccb535511858a779d099da
          Size/MD5:     2428 2f4cd99d96b0836f2c041ebad923a17b
          Size/MD5:    96498 2f7699f18e857a05ec9ea74ff2b34518
          Size/MD5:    94808 6bc31ebfb5185b93f5cac6f089e745ff

Ubuntu 990-2: Apache vulnerability

September 21, 2010
USN-860-1 introduced a partial workaround to Apache that disabled client initiated TLS renegotiation in order to mitigate CVE-2009-3555

Summary

Update Instructions

References

Severity
apache2 vulnerability

Package Information

Related News

24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
5.ShakingHands Esm H320
2 - 3 min read
At The Linux Foundation's Open Source Summit North America , Linus Torvalds, the creator of Linux, discussed various topics related to Linux
30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved