1

My website was scanned for PCI-compliance. Vulnerabilities found:

Apache HTTP Server Zero-Length Directory Name in LD_LIBRARY_PATH Vulnerability, CVE-2012-0883
Apache HTTP Server mod_rewrite Terminal Escape Sequence Vulnerability, CVE-2013-1862
Apache HTTP Server XSS Vulnerabilities via Hostnames, CVE-2012-3499 CVE-2012-4558

The site is running on apache2 (2.2.22-1ubuntu1.4) on Ubuntu 12.04 LTS. 'apt-get upgrade' says that it's already the latest version.

I found http://ubuntuforums.org/showthread.php?t=2011603 and upgraded apache2 to 2.4. But after upgrade, apache2 didn't start and gave me horrible errors. So I removed it and reinstalled apache2 2.2.22.

I googled for this issue and found some pages mentioning patch but I didn't understand them. My server management skill is very limited.

Can you help me with this problem? What's the easiest way to make apache2 PCI-compliant in my situation?

Thanks.

Sam

  • Are you sure that the scanner is really detecting those vulnerabilities, or might it just be drawing (faulty) conclusions from the version number? 2.2.22 != 2.2.22-1ubuntu1.4. At least the mod_rewrite and the XSS Vulnerabilities should be fixed in the Ubuntu version - launchpad.net/ubuntu/precise/+source/apache2/+changelog – andol Jan 20 '14 at 5:22
5

First, you show the vendor these, which show that you're running software that's either already fixed for, or is not affected by, the listed vulnerabilities:

Version string checking is a terrible way to check for these vulnerabilities, and the hits in the scan are all false positives.

Then, if the vendor doesn't accept this proof (some are really bad at this), just stop having your server show them what they're using to wrongly conclude that your server is "vulnerable":

ServerSignature Off
ServerTokens Prod

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.