Apache 'mod_proxy_balancer' Multiple Vulnerabilities

Bugtraq ID:	27236
Class:	Unknown
CVE:	CVE-2007-6420 CVE-2007-6421 CVE-2007-6422 CVE-2007-6423
Remote:	Yes
Local:	No
Published:	Jan 09 2008 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	sp3x is credited with the discovery of these issues.
Vulnerable:	Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux Server 11 x64 Turbolinux Turbolinux Server 11 Turbolinux Turbolinux Server 10.0.0 x64 TurboLinux Personal TurboLinux Multimedia Turbolinux FUJI 0 Turbolinux Appliance Server Workgroup Edition 1.0 Turbolinux Appliance Server Hosting Edition 1.0 Turbolinux Appliance Server 1.0 Workgroup Edition Turbolinux Appliance Server 1.0 Hosting Edition Turbolinux Appliance Server 2.0 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE Suse Linux Enterprise Desktop 10 SP2 SuSE Suse Linux Enterprise Desktop 10 SP1 SuSE Suse Linux Enterprise Desktop 10 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 0 S.u.S.E. Novell Linux POS 9 S.u.S.E. Novell Linux Desktop SDK 9.0 S.u.S.E. Novell Linux Desktop 9.0 rPath rPath Linux 2 rPath Appliance Platform Linux Service 2 Redhat Fedora 7 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Redhat Application Stack v2 0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 HP HP-UX B.11.31 HP HP-UX B.11.23 HP HP-UX B.11.11 HP Business Availability Center 8.01 Gentoo Linux Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apache Apache 2.2.6 Apache Apache 2.2.5 Apache Apache 2.2.4 Apache Apache 2.2.3 Apache Apache 2.2.2 Apache Apache 2.2 Apache Apache 2.2.6-dev Apache Apache 2.2.5-dev
Not Vulnerable:	Apache Apache 2.2.9 + Adobe Flash Media Server 3.5.3 + Adobe Flash Media Server 3.5.2 + Adobe Flash Media Server 3.5.1 Apache Apache 2.2.7-dev

Apache 'mod_proxy_balancer' Multiple Vulnerabilities

The Apache 'mod_proxy_balancer' module is prone to multiple vulnerabilities, including denial-of-service, memory-corruption, cross-site scripting, HTML-injection, and cross-site request-forgery issues.

Attackers can exploit these issues to inject arbitrary script code into vulnerable sections of the application, execute this script code in the browser of a user in the context of the affected site, and perform certain actions using the user's active session. Attackers can exploit the denial-of-service issue to deny further service to legitimate users. Exploiting the memory-corruption vulnerability is likely to cause a crash and could allow arbitrary code to run, but this has not been confirmed.

The issues affect Apache 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0; other versions may also be vulnerable.

Apache 'mod_proxy_balancer' Multiple Vulnerabilities

The researcher who found these issues has developed working exploit code, but it is not publicly available.

Apache 'mod_proxy_balancer' Multiple Vulnerabilities

Solution:
The vendor released Apache 2.2.7-dev to address these issues. Please see the references for more information.

NOTE: Apache 2.2.7-dev is a development version.

Apache 2.2.9 is available and addresses the cross-site request-forgery issue.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.4-3ubuntu0.2_powerpc.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.4_powerpc.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.4_powerpc.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.4_powerpc.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.4_powerpc.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.4_powerpc.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.4_powerpc.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_powerpc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.4_powerpc.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.4_sparc.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.4_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.4_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.4_sparc.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.4_sparc.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.4_sparc.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_sparc.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.4_sparc.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_sparc.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_sparc.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_sparc.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.8-1ubuntu0.4_amd64.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Apache Apache 2.2.5-dev

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Ubuntu Ubuntu Linux 7.10 sparc

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.4-3ubuntu0.2_sparc.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

Apache Apache 2.2.6-dev

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_powerpc.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_powerpc.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_powerpc.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_powerpc.deb

HP HP-UX B.11.23

• HP HPUXWSATW-B222-1123-32.depot
  PA-32
  http://software.hp.com


• HP HPUXWSATW-B222-1123-64.depot
  IA-64
  http://software.hp.com


• HP HPUXWSATW-B302-32.depot
  IA-64
  http://software.hp.com

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1u buntu0.4_lpia.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8- 1ubuntu0.4_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1 ubuntu0.4_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8- 1ubuntu0.4_lpia.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8 -1ubuntu0.4_lpia.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubunt u0.4_lpia.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ub untu0.4_lpia.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Ubuntu Ubuntu Linux 7.10 lpia

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.4-3u buntu0.2_lpia.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.4- 3ubuntu0.2_lpia.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.4-3 ubuntu0.2_lpia.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.4- 3ubuntu0.2_lpia.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.4 -3ubuntu0.2_lpia.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.4-3ubunt u0.2_lpia.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_lpia.deb
  http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.4-3ub untu0.2_lpia.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_i386.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_i386.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_i386.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_i386.deb

Ubuntu Ubuntu Linux 7.10 i386

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.4-3ubuntu0.2_i386.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

HP HP-UX B.11.11

• HP HPUXWSATW-B222-1111.depot
  PA-32
  http://software.hp.com


• HP HPUXWSATW-B302-64.depot
  http://software.hp.com

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu apache2-common_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2-doc_2.0.55-4ubuntu2.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 55-4ubuntu2.4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2-mpm-prefork_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2-mpm-worker_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2-prefork-dev_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2-threaded-dev_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2-utils_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.55-4ubuntu2.4_amd64.deb


• Ubuntu apache2_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4 ubuntu2.4_amd64.deb


• Ubuntu libapr0-dev_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 55-4ubuntu2.4_amd64.deb


• Ubuntu libapr0_2.0.55-4ubuntu2.4_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4 ubuntu2.4_amd64.deb

Ubuntu Ubuntu Linux 7.10 amd64

• Ubuntu apache2-doc_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-event_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2-mpm-perchild_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.4-3ubuntu0.2_all.deb


• Ubuntu apache2-mpm-prefork_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2-mpm-worker_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2-prefork-dev_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2-src_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 4-3ubuntu0.2_all.deb


• Ubuntu apache2-threaded-dev_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2-utils_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2.2-common_2.2.4-3ubuntu0.2_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.4-3ubuntu0.2_amd64.deb


• Ubuntu apache2_2.2.4-3ubuntu0.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.4-3u buntu0.2_all.deb

HP HP-UX B.11.31

• HP HPUXWSATW-B222-1131-32.depot
  IA-32
  http://software.hp.com


• HP HPUXWSATW-B222-1131-64.depot
  IA-64
  http://software.hp.com


• HP HPUXWSATW-B302-32.depot
  IA-64
  http://software.hp.com

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu apache2-doc_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-event_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-even t_2.2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2-mpm-perchild_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.2.8-1ubuntu0.4_all.deb


• Ubuntu apache2-mpm-prefork_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2-mpm-worker_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2-prefork-dev_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2-src_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2. 8-1ubuntu0.4_all.deb


• Ubuntu apache2-threaded-dev_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2-utils_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2.2-common_2.2.8-1ubuntu0.4_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common _2.2.8-1ubuntu0.4_i386.deb


• Ubuntu apache2_2.2.8-1ubuntu0.4_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1u buntu0.4_all.deb

Apple Mac OS X 10.5.2

• Apple SecUpd2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002.dmg

Apple Mac OS X Server 10.5.2

• Apple SecUpdSrvr2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002.dmg

Apple Mac OS X Server 10.5.5

• Apple SecUpdSrvr2008-007.dmg
  http://www.apple.com/support/downloads/securityupdate2008007serverleop ard.html

Apache Apache 2.2

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Apache Apache 2.2.2

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Apache Apache 2.2.3

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Apache Apache 2.2.4

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Apache Apache 2.2.5

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Apache Apache 2.2.6

• Apache Software Foundation httpd-2.2.9-win32-src.zip
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9-win32-src.zip


• Apache Software Foundation httpd-2.2.9.tar.gz
  http://apache.sunsite.ualberta.ca/httpd/httpd-2.2.9.tar.gz

Apache 'mod_proxy_balancer' Multiple Vulnerabilities

References:

• Apache Homepage (Apache Software Foundation)
  
• Apache httpd 2.2 vulnerabilities (Apache Software Foundation)
  
• Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability (SecurityReason Advisory)
  
• Changes with Apache 2.2.9 (Apache)
  
• SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vul ([email protected])
  
• RHSA-2008:0008-6 httpd security update (Red Hat)
  
• RHSA-2008:0966 Red Hat Application Stack v2.2 enhancement update (Red Hat)