Novell openSUSE

ソフト名：Novell openSUSE 11.3/11.4 (Apache APR, Apache APR-util 1.x)

回避策：openSUSE-SU-2011:0859-1にて対応

脆弱性：DoS攻撃, メモリの浪費, 無限再帰エラー, スタックオーバーフロー, 無限ループ

ソース：

http://www.opensuse.org/en/

https://hermes.opensuse.org/messages/10420089

http://secunia.com/advisories/41701/

http://secunia.com/advisories/44490/

http://secunia.com/advisories/44558/

http://secunia.com/advisories/45465/

http://dvw-j.blogspot.com/2011/05/apache-apache-apr-red-hat-desktop-red.html

http://dvw-j.blogspot.com/2011/05/apache-apache-apr-debian-gnulinux.html

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1623

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0419

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1928

CVE：CVE-2010-1623, CVE-2011-0419, CVE-2011-1928

危険性：Medium Risk

Red Hat JBoss Enterprise Web Server

ソフト名：Red Hat JBoss Enterprise Web Server EL4/EL5 (Apache Tomcat 2.2.x/5.x/6.x7.x, Apache APR-util 1.x, Apache APR 1.4.4未満)

回避策：RHSA-2011:0897-1にて対応

脆弱性：セキュリティ制限の回避, XSS, DoS攻撃, 機密情報の奪取, IPアドレスの曝露, 不正HTTPのリクエスト, クラッシュ, メモリの浪費, キャッシュ汚染, 不正HTMLの実行, スクリプトコード実行, プロセスのハング, 無限再帰エラー, スタックオーバーフロー

ソース：http://www.redhat.com/jboss/

https://rhn.redhat.com/errata/RHSA-2011-0897.html

http://secunia.com/advisories/39574/

http://secunia.com/advisories/40206/

http://secunia.com/advisories/41701/

http://secunia.com/advisories/42337/

http://secunia.com/advisories/43198/

http://secunia.com/advisories/44490/

http://secunia.com/advisories/43855/

http://dvw-j.blogspot.com/2011/02/apache-tomcat.html

http://dvw-j.blogspot.com/2011/05/apache-apache-apr-red-hat-desktop-red.html

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1157

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1452

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1623

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3718

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4172

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0013

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0419

CVE：CVE-2010-1157, CVE-2010-1452, CVE-2010-1623, CVE-2010-3718, CVE-2010-4172, CVE-2011-0013, CVE-2011-0419

危険性：Medium Risk

Sun Solaris

ソフト名：Sun Solaris 10 (Apache APR-util 0.x/1.x)

回避策：あり

脆弱性：機密情報の奪取, DoS攻撃, メモリの浪費, アプリケーションのクラッシュ

ソース：http://www.oracle.com/us/products/servers-storage/solaris/index.html?origref=http://secunia.com/advisories/product/4813/

http://blogs.sun.com/security/entry/cve_2009_1955_resource_management

http://blogs.sun.com/security/entry/cve_2009_1956_numeric_errors

http://blogs.sun.com/security/entry/cve_2009_0023_buffer_overflow

http://secunia.com/advisories/35284/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0023

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1955

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956

CVE：CVE-2009-0023, CVE-2009-1955, CVE-2009-1956

危険性：Medium Risk

Sun Solaris

ソフト名：Sun Solaris 10 (Apache APR-util 0.x/1.x)

回避策：あり

脆弱性：システムアクセス, 整数オーバーフロー, バッファオーバーフロー

ソース：http://www.oracle.com/us/products/servers-storage/solaris/index.html?origref=http://secunia.com/advisories/product/4813/

http://blogs.sun.com/security/entry/cve_2010_0740_record_of

http://secunia.com/advisories/36138/

http://secunia.com/advisories/44444/

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2412

CVE：CVE-2009-2412

危険性：Medium Risk

Apache APR-util

ソフト名：Apache APR-util 0.9.1～1.3.6
回避策：アップデートにて対応
脆弱性：DoS攻撃, メモリの浪費
ソース：http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3
http://www.securityfocus.com/bid/43673
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1623
http://www.debian.org/security/2010/dsa-2117
http://secunia.com/advisories/41701
http://www.vupen.com/english/advisories/2010/2556
http://www.vupen.com/english/advisories/2010/2557
CVE：CVE-2010-1623
危険性：Low Risk