PublicDateAtUSN: 2015-07-20
Candidate: CVE-2015-3185
PublicDate: 2015-07-20 23:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3185
 https://www.apache.org/dist/httpd/Announcement2.4.txt
 https://www.apache.org/dist/httpd/CHANGES_2.4.16
 http://svn.apache.org/viewvc?view=revision&revision=1684525
 https://ubuntu.com/security/notices/USN-2686-1
Description:
 The ap_some_auth_required function in server/request.c in the Apache HTTP
 Server 2.4.x before 2.4.14 does not consider that a Require directive may
 be associated with an authorization setting rather than an authentication
 setting, which allows remote attackers to bypass intended access
 restrictions in opportunistic circumstances by leveraging the presence of a
 module that relies on the 2.2 API behavior.
Ubuntu-Description:
Notes:
 mdeslaur> introduced by changes in 2.4, so doesn't affect 2.2
Bugs:
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS: 

Patches_apache2:
 upstream: http://svn.apache.org/viewvc?view=revision&revision=1684524 (trunk)
 upstream: http://svn.apache.org/viewvc?view=revision&revision=1684525 (2.4)
upstream_apache2: released (2.4.16)
precise_apache2: not-affected (2.2.22-1ubuntu1.9)
trusty_apache2: released (2.4.7-1ubuntu4.5)
trusty/esm_apache2: released (2.4.7-1ubuntu4.5)
utopic_apache2: ignored (reached end-of-life)
vivid_apache2: released (2.4.10-9ubuntu1.1)
devel_apache2: released (2.4.12-2ubuntu2)