-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------+ | EnGarde Secure Linux Security Advisory October 07, 2002 | | http://www.engardelinux.org/ ESA-20021007-024 | | | | Package: apache | | Summary: potential DoS, cross-site scripting, and buffer overflow | | vulnerabilities. | +------------------------------------------------------------------------+ EnGarde Secure Linux is a secure distribution of Linux that features improved access control, host and network intrusion detection, Web based secure remote management, complete e-commerce using AllCommerce, and integrated open source security tools. OVERVIEW - -------- This update fixes the following vulnerabilities in the Apache package: * CAN-2002-0839 The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard. * CAN-2002-0840 Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header. * CAN-2002-0843 Buffer overflows in the ApacheBench support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project may be found at cve.mitre.org. SOLUTION - -------- Users of the EnGarde Professional edition can use the Guardian Digital Secure Network to update their systems automatically. EnGarde Community users should upgrade to the most recent version as outlined in this advisory. Updates may be obtained from: ftp://ftp.engardelinux.org/pub/engarde/stable/updates/ http://ftp.engardelinux.org/pub/engarde/stable/updates/ Before upgrading the package, the machine must either: a) be booted into a "standard" kernel; or b) have LIDS disabled. To disable LIDS, execute the command: # /sbin/lidsadm -S -- -LIDS_GLOBAL To install the updated package, execute the command: # rpm -Uvh files You must now update the LIDS configuration by executing the command: # /usr/sbin/config_lids.pl To re-enable LIDS (if it was disabled), execute the command: # /sbin/lidsadm -S -- +LIDS_GLOBAL To verify the signatures of the updated packages, execute the command: # rpm -Kv files UPDATED PACKAGES - ---------------- These updated packages are for EnGarde Secure Linux Community Edition. Source Packages: SRPMS/apache-1.3.27-1.0.32.src.rpm MD5 Sum: 2c98864bb3be1ebf77a9c227cc15100a Binary Packages: i386/apache-1.3.27-1.0.32.i386.rpm MD5 Sum: 63b00c465bb617f3e08a04154a8ffea7 i686/apache-1.3.27-1.0.32.i686.rpm MD5 Sum: aa9ed8ab148de56f696ee6f2a52a5f77 REFERENCES - ---------- Guardian Digital's public key: http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY Apache's Official Web Site: http://httpd.apache.org/ Security Contact: securityat_private EnGarde Advisories: http://www.engardelinux.org/advisories.html - -------------------------------------------------------------------------- $Id: ESA-20021007-024-apache,v 1.2 2002/10/07 17:39:21 rwm Exp $ - -------------------------------------------------------------------------- Author: Ryan W. Maple <ryanat_private> Copyright 2002, Guardian Digital, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9ocymHD5cqd57fu0RAmLQAJ400P1GBFhJGNRK9NfTFF+d7/oI3gCdE53o DCxn2lIkwHgJHZC10ud3vbI= =vySe -----END PGP SIGNATURE----- ------------------------------------------------------------------------ To unsubscribe email engarde-security-requestat_private with "unsubscribe" in the subject of the message. Copyright(c) 2001 Guardian Digital, Inc. EnGardeLinux.org ------------------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Mon Oct 07 2002 - 11:50:10 PDT