Fix (APAR):  PI13028

Status:  Fix

Release:  8.5.5.2,8.5.5.1,8.5.5,8.5.0.2

Operating System:  AIX,HP-UX,Linux,Solaris,Windows,z/OS

Supersedes Fixes:  

CMVC Defect:  xxxxxx

Byte size of APAR:  1589654

Date: 2014-05-14

Abstract:  CVE-2014-0098: Potential vulnerability in IBM HTTP Server mod_log_config

Description/symptom of problem:  


PI13028 resolves the following problem:

ERROR DESCRIPTION:
A vulnerability in the mod_log_config module could result in a denial of service.

LOCAL FIX:                                                      
None                                                            

PROBLEM SUMMARY:
Potential DoS in IBM HTTP Server.

PROBLEM CONCLUSION:
This fix is targeted for IBM HTTP Server fix packs:             
- 7.0.0.33                                                       
- 8.0.0.9                                                        
- 8.5.5.3                                                        







Directions to apply fix:  
Special Instructions:
None

NOTE:
The user must:
* Be at V1.4.3 or newer of the Installation Manager. Certain iFixes may require
  a newer version of the Installation Manager and the Installation Manager will
  inform you during the installation process if a newer version is required.
* Be logged in with the same authority level when unpacking a fix, fix pack or
  refresh pack.

The IBM Information Center can provide details, if needed, on the use of the
Installation Manager to apply the interim fix:
http://publib.boulder.ibm.com/infocenter/install/v1r4/index.jsp.

1) Shutdown IBM HTTP Server

2) Apply the interim fix using Installation Manager

3) Restart IBM HTTP Server






Directions to remove fix:  
The IBM Information Center can provide details, if needed, on the use of the
Installation Manager to remove the interim fix:
http://publib.boulder.ibm.com/infocenter/install/v1r4/index.jsp.

1) Shutdown IBM HTTP Server

2) Remove the interim fix using Installation Manager

3) Restart IBM HTTP Server






Directions to re-apply fix:  
1) Stop IBM HTTP Server.

2) Follow the Fix instructions to apply the fix.

3) Restart IBM HTTP Server.






Additional Information: