Apache vulnerabilities

Question

We've recently had some security consultants go through our environment and the report they've provided has advised that some high priority upgrades are required on our NetWare servers around the Apache versions.
We are running NW65sp7, and the report advises upgrading Modjk to 1.2.27 or higher (due to Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability), and also upgrading Apache from 2.2.3, citing a list of vulnerabilities (for example Apache APR and APR-util Multiple Integer Overflow Vulnerabilities and Apache 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability) .
So 2 queries, searching the Apache website around these vulnerabilities does not list NetWare as an affected NOS, so is is really something I need to worry about? (after helping them out on site I have my doubts as to how Novell savvy these people were)
And secondly, assuming that it is something I need to worry about, will going to SP8 sort them out or should I upgrade Apache separately? (We are going to SP8 in the next couple of weeks anyway). I would have thought that if these were serious vulnerabilities the fix would have been bundled into an SP release or at least a Novell patch.
Thanks
Dean

Answer 1

On 24/11/2009 03:26, ddnicholls wrote:
> We've recently had some security consultants go through our environment
> and the report they've provided has advised that some high priority
> upgrades are required on our NetWare servers around the Apache
> versions.
I'm always wary of security scans of NetWare servers since things are
often flagged based on version numbers rather than whether the
vulnerability actually exists for that device in question. The devil is
in the detail as they say.
> We are running NW65sp7, and the report advises upgrading Modjk to
> 1.2.27 or higher (due to 'Apache Tomcat Mod_JK.SO Arbitrary Code
> Execution Vulnerability' (http://www.securityfocus.com/bid/22791)), and
> also upgrading Apache from 2.2.3, citing a list of vulnerabilities (for
> example 'Apache APR and APR-util Multiple Integer Overflow
> Vulnerabilities' (http://www.securityfocus.com/bid/35949) and 'Apache
> 'Options' and 'AllowOverride' Directives Security Bypass Vulnerability'
> (http://www.securityfocus.com/bid/35115)) .
NetWare 6.5 SP7 includes Apache 2.0.59 and mod_jk 1.2.21.
> So 2 queries, searching the Apache website around these vulnerabilities
> does not list NetWare as an affected NOS, so is is really something I
> need to worry about? (after helping them out on site I have my doubts as
> to how Novell savvy these people were)
That's difficult to find out - NetWare is a different beast to Linux
(for example) and how Apache is implemented is different.
> And secondly, assuming that it is something I need to worry about, will
> going to SP8 sort them out or should I upgrade Apache separately? (We
> are going to SP8 in the next couple of weeks anyway). I would have
> thought that if these were serious vulnerabilities the fix would have
> been bundled into an SP release or at least a Novell patch.
NetWare 6.5 SP8 includes Apache 2.0.63 and mod_jk 1.2.23.
If you are only doing web serving from the server in question then you
could manually install the latest version of Apache 2.2.x (currently
2.2.14).
However if the server handles iPrint, NetStorage, etc. then the relevant
Apache modules are only for Apache 2.0.x and there are no plans to
provide Apache 2.2.x compatible modules.
It may well be that whilst Apache and mod_jk are not the latest versions
they may not be vulnerable as the necessary fixes may be included - you
see this SUSE Linux.
What you can do is stop your web server giving out detailed information
which is what these security scans use and help hackers identify
targets. Within the httpd.conf set 'ServerSignature Off' and
'ServerTokens ProductOnly'. See
http://httpd.apache.org/docs/2.0/mod/core.html
HTH.
Simon
Novell Knowledge Partner (NKP)
Do you work with Novell technologies at a university, college or school?
If so, your campus could benefit from joining the Novell Technology
Transfer Partners (TTP) group. See www.novell.com/ttp for more details.