0

A security vulnerability was found in Apache in April 2012 that is a PCI compliance issue: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0883

I have always kept my servers (CentOS) up to date with yum. I've been unable to find a repo with httpd-2.2.23 (currently running 2.2.22). It's been a really long time since I've built anything from source so I'm not thrilled about doing it but will if needed.

My question is, how do I go about this and NOT break the yum update process?

TD

3 Answers 3

0

Backup your apache config files, uninstall httpd , httpd-devel and any other httpd package,then you can manually download rpm's from here.

And install it with yum or rpm.

yum localinstall pkg_name
rpm -ivh pkg_name

Hope this helps!

2
  • The link to pkgs.org is actually a link to an rpm at centos.alt.ru. I'm leery of anything @ .ru additionally, the site is non-responsive. Anywhere else to find the rpm?
    – Tim Duncklee
    Oct 24, 2012 at 18:47
  • you can try to follow instructions from here httpd.apache.org/docs/2.4/platform/rpm.html Other options are compile it by yourself or wait for update
    – alan978
    Oct 24, 2012 at 19:16
2

You have nothing to do to your server.

According to Red Hat, the versions of Apache shipped with RHEL (and by extension, CentOS) are not vulnerable to this attack.

You do need to provide this information to your PCI compliance auditor.

3
  • Michael, I wish it were that simple. I can not run the shipping versions that came with stock CentOS due to other software I have to run on the server. Therefore, i have to do the upgrade to be PCI compliant. So far it looks like @alan978 has the best solution. Oct 24, 2012 at 22:34
  • If you aren't running the Apache that came with CentOS, why does your question imply that you are? You should be specific about the environment if you want an answer that's appropriate to you. Oct 24, 2012 at 22:36
  • Michael, I apologize. I assumed the version number would indicate that I was not running "stock" versions. I will do my best to be clearer from now on. Thx. TD Oct 25, 2012 at 0:14
1

Don't change anything.

Red Hat (and by extension, CentOS) gets security fixes backported from newer versions, instead of upgrading to newer versions wholesale and potentially introducing compatibility problems.

In this case, there's no backport because the packaged version is not vulnerable. See here; this result from the scan is a false positive.

Raw version number matching for vulnerability checking is often inaccurate; consider changing to ServerTokens Prod.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.