[CLA-2002:504] Conectiva Linux Security Announcement - apache
Date: Tue, 2 Jul 2002 11:22:38 -0300
From: secure@conectiva.com.br
To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net,
Subject: [CLA-2002:504] Conectiva Linux Security Announcement - apache
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : apache
SUMMARY : off-by-one mod_ssl buffer overflow
DATE : 2002-07-02 11:21:00
ID : CLA-2002:504
RELEVANT
RELEASES : 6.0, 7.0, 8
- -------------------------------------------------------------------------
DESCRIPTION
Apache[1] is the most popular webserver in use today. "mod_ssl"[2] is
an Apache module which enables the use of encrypted connections
("https://") to the web server and provides a set of crypto and
authentication related functions.
This module is not part of the apache distribution, but is bundled
and enabled by default in the Conectiva Linux Apache packages.
An off-by-one buffer overflow vulnerability exists in the code which
handles entries in .htaccess files in mod_ssl <= 2.8.9. It was
discovered[3] by Frank DENIS (Jedi/Sector One) <j@pureftpd.org>.
The htaccess mechanism is disabled by default in Conectiva Linux and
can be controled by the "AllowOverride" variable in the apache
configuration file. It is useful to allow non privileged users to
customize the configuration of their sites.
An attacker who can manipulate the contents of the .htaccess file can
potentially cause a DoS or even execute arbitrary commands in the
httpd service context, which is run by an unprivileged user
(typically "www" or "nobody").
SOLUTION
It is recommended that all apache users upgrade their packages.
IMPORTANT: the apache server has to be restarted after upgrading the
packages. To do this, please execute, as root:
# service httpd stop
(wait a few seconds and check with "ps ax|grep httpd" if there are
any httpd processes running. On a busy webserver this could take a
little longer.)
and:
# service httpd start
REFERENCES:
1. http://httpd.apache.org
2. http://www.modssl.org
3. http://online.securityfocus.com/archive/1/279074
DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.26-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.26-1U70_5cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-devel-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-doc-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/apache-1.3.26-1U8_2cl.src.rpm
ADDITIONAL INSTRUCTIONS
Users of Conectiva Linux version 6.0 or higher may use apt to perform
upgrades of RPM packages:
- add the following line to /etc/apt/sources.list if it is not there yet
(you may also use linuxconf to do this):
rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates
(replace 6.0 with the correct version number if you are not running CL6.0)
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE9Ibct42jd0JmAcZARAm0xAJwMVSMYNfk6mn0zgp1gxGg1RH1dNQCfdJid
i4D9iIggPrqiUJwDG7X4O4o=
=msXR
-----END PGP SIGNATURE-----
