PH61893, PH62263: IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server

Download Description

• CVE-2024-38472
  • Vulnerable Configurations: IHS on Windows
• CVE-2024-38473, CVE-2024-38477
  • Vulnerable Configurations: IHS 9.0 with mod_proxy loaded
• CVE-2024-38474, CVE-2024-38475
  • Vulnerable Configurations: IHS with mod_rewrite loaded.
    See https://httpd.apache.org/security/vulnerabilities_24.html for mod_rewrite specifics.
• CVE-2024-38476
  • Vulnerable Configurations:  IHS with mod_negotiation or CGI modules loaded
• CVE-2024-39573
  • Vulnerable: IHS with both mod_rewrite and mod_proxy loaded
    See https://httpd.apache.org/security/vulnerabilities_24.html for mod_rewrite specifics.

• CVE-2024-40898
  • Vulnerable Configurations: IHS with mod_rewrite in use on Windows
• CVE-2024-40725
  • Vulnerable Configurations: IHS w/ IFPH61893 installed and with `AddType` directive used to configure a handler (such as PHP or other scripting languages).
    • AddType is a legacy method from Apache 1.3 to associate a a file extension with a handler. Modern configurations would use "AddHandler" which is unaffected.

• If non-malicious URL's use encoded question marks (%3F), some RewriteRules that add a "?" to the substitution will return 403 unless the flag UnsafeAllow3F is added.
• If a mod_rewrite substitution begins with a variable or back-reference, and has no PT flag, and the first path segment matches a directory at the root of the filesystem, the substitution will no longer map the URL to that directory unless the flag UnsafePrefixStat is added.

• Use of network shares (such as //servername) requires the IP or hostname to be specified with the UNCList directive. The directive should appear before the directives (such as Alias or DocumentRoot or <Directory>) that reference the //servername remote path.
  
  The UNCList directive takes multiple hostname/IP arguments but cannot be repeated.
   

  UNCLIst myserver other-server
  
  DocumentRoot "//myserver/Doclinks"
  <Directory "//myserver/Doclinks">
    ...
  </Directory>
  
  Alias /images "//otherserver/images"
  <Directory "//other-server/images">
    ...
  </Directory>