Protection against "CRIME attack"/Disable SSL compression under Ubuntu/Apache/2.2.22

Question

I'm trying to disable SSL compression in my server, but can't because SSLCompression option isn't yet avaliable with my current apache installation.

I found a patch that will give me that option http://pastebin.com/FnvUyjdJ, but have no ideia how to apply it. Could you guys help me?

What exact version of Ubuntu and Apache are you running. According to Ubuntu, this was fixed in version of 2.2.22 provided to Ubutnu 12.04 and 12.10 - http://www.ubuntu.com/usn/usn-1627-1/ — Ryan Gibbons, Mar 15 '13 at 05:47
According with Apache website "Available in httpd 2.4.3 and later" if I put "SSLCompression off" and try to restart, I get an error. My Ubuntu is 12.04.1. — Lucas Pelegrino, Mar 15 '13 at 07:39

score 0 · Answer 1 · answered Mar 15 '13 at 10:39

0

This issue was resolved with a backported patch. You only need to update Apache to the version given in the security notice, or a later version.

answered Mar 15 '13 at 10:39

Michael Hampton

244,070
43
506
972

I did `apt-get -u install apache2` and now none of my virtual hosts are accessible and no error is logged =O What could it be? – Lucas Pelegrino Mar 15 '13 at 17:36

score 0 · Answer 2 · answered Mar 15 '13 at 14:30

This was provided by Ubuntu in the precise-security source in your /etc/apt/sources.list

https://launchpad.net/ubuntu/+source/apache2/2.2.22-1ubuntu1.2

Something like this

deb http://archive.ubuntu.com/ubuntu precise-security main restricted universe deb-src http://archive.ubuntu.com/ubuntu precise-security main restricted universe

Protection against "CRIME attack"/Disable SSL compression under Ubuntu/Apache/2.2.22

2 Answers2