SB2014102006 - Multiple vulnerabilities in HP-UX Apache Server Suite running Apache Tomcat or PHP

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2013-4248)

The vulnerability allows a remote attacker to conduct MITM-attack on the target system.

The weakness exists due to the openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '' character in a domain name in the Subject Alternative Name field of an X.509 certificate. A remote attacker can use man-in-the-middle technique and spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

2) Input validation error (CVE-ID: CVE-2013-4286)

The vulnerability allows a remote attacker to perform a request-smuggling attack.

The vulnerability exists due to HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers. A remote attacker can trigger incorrect identification of a request's length and conduct request-smuggling attacks via multiple Content-Length headers or a Content-Length header and a "Transfer-Encoding: chunked" header.

This vulnerability exists because of an incomplete fix for CVE-2005-2090.

Remediation

Install update from vendor's website.

References

• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04483248