How to upgrade apache2 for PCI

Question

My website was scanned for PCI-compliance. Vulnerabilities found:

Apache HTTP Server Zero-Length Directory Name in LD_LIBRARY_PATH Vulnerability, CVE-2012-0883
Apache HTTP Server mod_rewrite Terminal Escape Sequence Vulnerability, CVE-2013-1862
Apache HTTP Server XSS Vulnerabilities via Hostnames, CVE-2012-3499 CVE-2012-4558

The site is running on apache2 (2.2.22-1ubuntu1.4) on Ubuntu 12.04 LTS. 'apt-get upgrade' says that it's already the latest version.

I found http://ubuntuforums.org/showthread.php?t=2011603 and upgraded apache2 to 2.4. But after upgrade, apache2 didn't start and gave me horrible errors. So I removed it and reinstalled apache2 2.2.22.

I googled for this issue and found some pages mentioning patch but I didn't understand them. My server management skill is very limited.

Can you help me with this problem? What's the easiest way to make apache2 PCI-compliant in my situation?

Thanks.

Sam

Answer 1

First, you show the vendor these, which show that you're running software that's either already fixed for, or is not affected by, the listed vulnerabilities:

• http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-3499.html
• http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-4558.html
• http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1862.html
• http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-0883.html

Version string checking is a terrible way to check for these vulnerabilities, and the hits in the scan are all false positives.

Then, if the vendor doesn't accept this proof (some are really bad at this), just stop having your server show them what they're using to wrongly conclude that your server is "vulnerable":

ServerSignature Off
ServerTokens Prod