[Linux] Apache HTTP Server 취약점 조치 (CVE-2021-44224, CVE-2021-44790)

0. 조치 환경

• CentOS Linux release 7.9.2009 (Core)

1. 취약점 내용

• 영향받는 버전: 2.4.51 및 이전 버전
• Apache HTTP Server에서 널 포인터 역참조로 인해 발생하는 서비스 거부 취약점(CVE-2021-44224)
• Apache HTTP Server에서 입력값 검증이 미흡하여 발생하는 버퍼오버플로우 취약점(CVE-2021-44790)
• https://krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=36399 

2. 조치 방안

• Apache HTTP Server 버전을 업데이트합니다. (2.4.52)

3. 업데이트

• 기존에 설치된 Apache HTTP Server를 지우고 시작합니다.

3.1. 관련 패키지 설치

• 관련 패키지를 꼭 설치해야 컴파일 설치 시 오류가 나지 않습니다.

# yum update -y 

# yum install -y gcc gcc-c++ pcre-devel expat-devel

3.2. httpd 관련 설치 파일 다운로드

• pcre, httpd, apr, apr-util을 다운로드합니다.
• https://downloads.apache.org/

// 다운 받을 경로
# cd /usr/local/src 

# wget https://sourceforge.net/projects/pcre/files/pcre/8.45/pcre-8.45.tar.gz
# wget https://downloads.apache.org/httpd/httpd-2.4.52.tar.gz
# wget https://downloads.apache.org/apr/apr-1.7.0.tar.gz
# wget https://downloads.apache.org/apr/apr-util-1.6.1.tar.gz

# tar zxvf pcre-8.45.tar.gz
# tar zxvf httpd-2.4.52.tar.gz
# tar zxvf apr-1.7.0.tar.gz
# tar zxvf apr-util-1.6.1.tar.gz

3.3. pcre 컴파일 설치

# cd pcre-8.45/
./configure --prefix=/usr/local/src

# make && make install

3.4. httpd 컴파일 설치

# cd /usr/local/src 

# mv apr-1.7.0 ./httpd-2.4.52/srclib/apr
# mv apr-util-1.6.1 ./httpd-2.4.52/srclib/apr-util

# cd httpd-2.4.52/

# ./configure \
--prefix=/usr/local/apache \
--with-included-apr \
--with-pcre=/usr/local/bin/pcre-config

# make && make install

3.5. Service 등록

# vi /usr/lib/systemd/system/httpd.service

[Unit]
Description=Apache Service

[Service]
Type=forking
#EnvironmentFile=/usr/local/apache/bin/envvars
PIDFile=/usr/local/apache/logs/httpd.pid
ExecStart=/usr/local/apache/bin/apachectl start
ExecReload=/usr/local/apache/bin/apachectl graceful
ExecStop=/usr/local/apache/bin/apachectl stop
KillSignal=SIGCONT
PrivateTmp=true

[Install]
WantedBy=multi-user.target

# systemctl daemon-reload

3.5. httpd 확인

# systemctl start httpd

# systemctl status httpd
● httpd.service - Apache Service
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
   Active: active (running) since 목 2021-12-23 15:11:30 KST; 2s ago
  Process: 12969 ExecStart=/usr/local/apache/bin/apachectl start (code=exited, status=0/SUCCESS)
 Main PID: 12974 (httpd)
    Tasks: 82
   CGroup: /system.slice/httpd.service
           ├─12974 /usr/local/apache/bin/httpd -k start
           ├─12975 /usr/local/apache/bin/httpd -k start
           ├─12976 /usr/local/apache/bin/httpd -k start
           └─12977 /usr/local/apache/bin/httpd -k start

12월 23 15:11:30 localhost.localdomain systemd[1]: Starting Apache Service...
12월 23 15:11:30 localhost.localdomain apachectl[12969]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using localhost.localdomain. Set the 'ServerName' directive globally t...ss this message
12월 23 15:11:30 localhost.localdomain systemd[1]: Can't open PID file /usr/local/apache/logs/httpd.pid (yet?) after start: No such file or directory
12월 23 15:11:30 localhost.localdomain systemd[1]: Started Apache Service.
Hint: Some lines were ellipsized, use -l to show in full.

# netstat -ntap | grep LISTEN | grep 80 | grep -v grep
tcp6       0      0 :::80                   :::*                    LISTEN      12974/httpd

실행 화면