CVE-2013-5704

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

This update for the Apache Web Server introduces directives to control two protocol options:

* HttpContentLengthHeadZero: Allow responses to HEAD request with
  Content-Length of 0
* HttpExpectStrict: Allow the administrator to control whether clients
  must send '100-continue'

MODULE_MAGIC_NUMBER_MINOR has been increased to 24, as this change is not forward-compatible. Modules built against this release might not work correctly with older releases of the Apache Web Server.

Apache2 updated to fix four security issues and one non-security bug.

The following vulnerabilities have been fixed:

• mod_headers rules could be bypassed via chunked requests. Adds 'MergeTrailers' directive to restore legacy behavior. (bsc#871310, CVE-2013-5704)
• An empty value in Content-Type could lead to a crash through a null pointer dereference and a denial of service. (bsc#899836, CVE-2014-3581)
• Remote attackers could bypass intended access restrictions in mod_lua LuaAuthzProvider when multiple Require directives with different arguments are used. (bsc#909715, CVE-2014-8109)
• Remote attackers could cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function. (bsc#918352, CVE-2015-0228)

The following non-security issues have been fixed:

• The Apache2 systemd service file was changed to fix situation where apache wouldn't start at boot when using an encrypted certificate because the user wasn't prompted for password during boot. (bsc#792309)

Additionally, mod_imagemap is now included by default in the package. (bsc#923090)

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Martin Holst Swende discovered that the mod_headers module allowed HTTP trailers to replace HTTP headers during request processing. A remote attacker could possibly use this issue to bypass RequestHeaders directives. (CVE-2013-5704)

Mark Montague discovered that the mod_cache module incorrectly handled empty HTTP Content-Type headers. A remote attacker could use this issue to cause the server to stop responding, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)

Teguh P. Alko discovered that the mod_proxy_fcgi module incorrectly handled long response headers. A remote attacker could use this issue to cause the server to stop responding, leading to a denial of service. This issue only affected Ubuntu 14.10. (CVE-2014-3583)

It was discovered that the mod_lua module incorrectly handled different arguments within different contexts. A remote attacker could possibly use this issue to bypass intended access restrictions. This issue only affected Ubuntu 14.10. (CVE-2014-8109)

Guido Vranken discovered that the mod_lua module incorrectly handled a specially crafted websocket PING in certain circumstances. A remote attacker could possibly use this issue to cause the server to stop responding, leading to a denial of service. This issue only affected Ubuntu 14.10. (CVE-2015-0228)