Ubuntu – Does CVE-2012-0883 apply to Ubuntu

Apache2Security

Does the Apache vulnerability CVE-2012-0883 affect Ubuntu? Have tried searching for it at ubuntu.com but with no hits.

I note that Ubuntu releases an Ubuntu Security Notice (USN) when it issues an update for the vulnerability e.g. USN-1627-1 for CVE-2012-2687 and CVE-2012-4929. However I cannot find any corresponding USN for CVE-2012-0883 although I did find this:

http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-0883.html

And if Ubuntu is not affected by the vulnerability, what version of Apache contains the fix?

Best Answer

It's clearly written in the page you have linked:

Upstream:                               released (2.4.2)
Ubuntu 8.04 LTS (Hardy Heron):          not-affected
Ubuntu 10.04 LTS (Lucid Lynx):          not-affected
Ubuntu 11.04 (Natty Narwhal):           not-affected
Ubuntu 11.10 (Oneiric Ocelot):          not-affected
Ubuntu 12.04 LTS (Precise Pangolin):    not-affected

Also, in the same page, there's written:

jdstrand> Debian/Ubuntu packages contain 038_no_LD_LIBRARY_PATH (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276670 for more information)

And if you look at the changelog included in the bug you can see:

apache2 (2.0.52-2) unstable; urgency=high
[...]
  * Move envvars to /etc/apache2/ and add patch 038_no_LD_LIBRARY_PATH to
    remove the extraneous LD_LIBRARY_PATH from envvars (closes: #276670)

This means that the bug has been fixed in Debian since version 2.0.52.

Last but not least, if you look at your /etc/apache2/envvars or /usr/share/apache2/build/envvars-std, you'll see that they don't contain any malicious LD_LIBRARY_PATH.

Related Question