0

My company's web server has recently failed our quarterly PCI scan on the basis of the Apache HTTPOnly Cookie Disclosure, a vulnerability only fixed from apache 2.2.22 onwards. I'm currently running Ubuntu 10.04 LTS with apache 2.2.14 and have searched high and low to find a repository for apache 2.2.22 compatible with 10.04LTS so that I may upgrade it with apt-get.

Does one exist?? Or do I need to manually update apache? Or do I need to upgrade to 12.04LTS in order to install apache 2.2.22?

Thanks a lot and I hope this helps some others out there, as I would imagine many other Techies have failed their quarterly PCI scans on the same basis!!

Improve this question

1 Answer 1

Reset to default
0

Presumably Paypal's quarterly scan is not due for a while.

From what I've been able to determine, the issue is that the cookie is not accessible by javascript - but it's value is exposed within the html body - so if you could inject javascript into the page then it could be captured - so exploitation is really dependant on a secondary attack vector.

Do PCI really publish a list of CERTs you must be compliant with?

Regardless, you can solve the problem by configuring an custom ErrorDocument for 400 errors - you should really not rely on the default pages for any error message.

Improve this answer
1
  • Thanks. No, the PCI just ensure your scans return compliant from a verified scanner. Any vulnerabilities must be addressed. I'm about to be rescanned so hopefully your fix has done the job!
    – hav
    Aug 7, 2012 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .