8677649 2002-07-02 11:22 -0300  /123 rader/ <secure@conectiva.com.br>
Sänt av: joel@lysator.liu.se
Importerad: 2002-07-02  21:54  av Brevbäraren
Extern mottagare: conectiva-updates@papaleguas.conectiva.com.br
Extern mottagare: lwn@lwn.net
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: security-alerts@linuxsecurity.com
Mottagare: Bugtraq (import) <22921>
Ärende: [CLA-2002:504] Conectiva Linux Security Announcement - apache
------------------------------------------------------------
From: secure@conectiva.com.br
To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net,
 bugtraq@securityfocus.com, security-alerts@linuxsecurity.com
Message-ID: <200207021422.LAA08058@frajuto.distro.conectiva>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : apache
SUMMARY   : off-by-one mod_ssl buffer overflow
DATE      : 2002-07-02 11:21:00
ID        : CLA-2002:504
RELEVANT
RELEASES  : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 Apache[1] is the most popular webserver in use today. "mod_ssl"[2] is
 an Apache module which enables the use of encrypted connections
 ("https://") to the web server and provides a set of crypto and
 authentication related functions.
 
 This module is not part of the apache distribution, but is bundled
 and enabled by default in the Conectiva Linux Apache packages. 
 
 An off-by-one buffer overflow vulnerability exists in the code which
 handles entries in .htaccess files in mod_ssl <= 2.8.9. It was
 discovered[3] by Frank DENIS (Jedi/Sector One) <j@pureftpd.org>.
 
 The htaccess mechanism is disabled by default in Conectiva Linux and
 can be controled by the "AllowOverride" variable in the apache
 configuration file. It is useful to allow non privileged users to
 customize the configuration of their sites.
 
 An attacker who can manipulate the contents of the .htaccess file can
 potentially cause a DoS or even execute arbitrary commands in the
 httpd service context, which is run by an unprivileged user
 (typically "www" or "nobody").


SOLUTION
 It is recommended that all apache users upgrade their packages.
 
 IMPORTANT: the apache server has to be restarted after upgrading the
 packages. To do this, please execute, as root:
 
 # service httpd stop
 
 (wait a few seconds and check with "ps ax|grep httpd" if there are
 any httpd processes running. On a busy webserver this could take a
 little longer.)
 
 and:
 
 # service httpd start
 
 
 REFERENCES:
 1. http://httpd.apache.org
 2. http://www.modssl.org
 3. http://online.securityfocus.com/archive/1/279074


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-devel-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/apache-doc-1.3.26-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/apache-1.3.26-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-devel-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/apache-doc-1.3.26-1U70_5cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/apache-1.3.26-1U70_5cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-devel-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/apache-doc-1.3.26-1U8_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/apache-1.3.26-1U8_2cl.src.rpm


ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running
CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples
 can be found at
 http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE9Ibct42jd0JmAcZARAm0xAJwMVSMYNfk6mn0zgp1gxGg1RH1dNQCfdJid
i4D9iIggPrqiUJwDG7X4O4o=
=msXR
-----END PGP SIGNATURE-----
(8677649) /<secure@conectiva.com.br>/-----(Ombruten)