8736459 2002-07-16 15:16 -0700  /180 rader/ <security@caldera.com>
Sänt av: joel@lysator.liu.se
Importerad: 2002-07-17  00:37  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: announce@lists.caldera.com
Extern mottagare: security-alerts@linuxsecurity.com
Mottagare: Bugtraq (import) <23114>
Ärende: Security Update: [CSSA-2002-031.0] Linux: mod_ssl off-by-one error
------------------------------------------------------------
From: security@caldera.com
To: bugtraq@securityfocus.com, announce@lists.caldera.com,
 security-alerts@linuxsecurity.com
Message-ID: <20020716151610.A15877@caldera.com>

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: mod_ssl off-by-one error
Advisory number: 	CSSA-2002-031.0
Issue date: 		2002 July 16
Cross reference:
______________________________________________________________________________


1. Problem Description

	mod_ssl registers a rewrite_command hook when backward
	compatibility is enabled. The ssl_compat_directive() is called
	for every line read in a configuration file, and contains an
	off-by-one error while doing so.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
					prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
					prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	OpenLinux 3.1 Server		prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
					prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	OpenLinux 3.1 Workstation	prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
					prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater,
	called cupdate (or kcupdate under the KDE environment), to
	update these packages rather than downloading and installing
	them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	c998c03318358630584215190a470c9c
	mod_ssl-2.8.5_1.3.22-3.i386.rpm
	1586b281a0888d306cb5efe35ff86954
	mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	4.3 Installation

	rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
	rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	850ea026cc10315dce3dbaef9feabc8c
mod_ssl-2.8.5_1.3.22-3.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

	5.2 Packages

	ef912916b08251e9f6b0876a8c052b8f
	mod_ssl-2.8.5_1.3.22-3.i386.rpm
	d57dae4310139ce3ea0e3979e643a9ac
	mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	5.3 Installation

	rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
	rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

	5.5 Source Packages

	c34cc1e566f049573dc41b1323849101
mod_ssl-2.8.5_1.3.22-3.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	6.2 Packages

	3711fdb7fbc8a8f0dd0b5c2408709872
	mod_ssl-2.8.5_1.3.22-3.i386.rpm
	0522228a7472586099b91a499a9b2b4f
	mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	6.3 Installation

	rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
	rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	6.5 Source Packages

	bf52c48ab7e18daa6cea04928fb85419
mod_ssl-2.8.5_1.3.22-3.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

	7.2 Packages

	0769c955e7be0acee8a78929cbb9d96c
	mod_ssl-2.8.5_1.3.22-3.i386.rpm
	4d6773201e7ebd88fb2153e7eaca13b0
	mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	7.3 Installation

	rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
	rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

	7.5 Source Packages

	ad1ede2408cf40e319fc647986eca21b
mod_ssl-2.8.5_1.3.22-3.src.rpm


8. References

	Specific references for this advisory:
		http://www.modssl.org/

	Caldera security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr866328, fz521400,
	erg712092.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


10. Acknowledgements

	Frank Denis (j@pureftpd.org) discovered and researched this
	vulnerability.

______________________________________________________________________________
(8736459) /<security@caldera.com>/--------(Ombruten)
Bilaga (application/pgp-signature) i text 8736460
8736460 2002-07-16 15:16 -0700  /9 rader/ <security@caldera.com>
Importerad: 2002-07-17  00:37  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: announce@lists.caldera.com
Extern mottagare: security-alerts@linuxsecurity.com
Mottagare: Bugtraq (import) <23115>
Bilaga (text/plain) till text 8736459
Ärende: Bilaga till: Security Update: [CSSA-2002-031.0] Linux: mod_ssl off-by-one error
------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj00myoACgkQbluZssSXDTEonwCg+RUinrIZxqwbbt3zNL7qrfsM
UewAn0n+Ft0T5qU//SkqEG6fKNvw+1nM
=5//3
-----END PGP SIGNATURE-----
(8736460) /<security@caldera.com>/------------------