[ GLSA 200407-18 ] mod_ssl: Format string vulnerability

[Kurt Lieber <klieber () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200407-18
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: mod_ssl: Format string vulnerability
      Date: July 22, 2004
      Bugs: #57379
        ID: 200407-18

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A bug in mod_ssl may allow a remote attacker to execute arbitrary code
when Apache is configured to use mod_ssl and mod_proxy.

Background
==========

mod_ssl provides Secure Sockets Layer encryption and authentication to
Apache 1.3.

Affected packages
=================

    -------------------------------------------------------------------
     Package          /   Vulnerable   /                    Unaffected
    -------------------------------------------------------------------
  1  net-www/mod_ssl       <= 2.8.18                         >= 2.8.19

Description
===========

A bug in ssl_engine_ext.c makes mod_ssl vulnerable to a ssl_log()
related format string vulnerability in the mod_proxy hook functions.

Impact
======

Given the right server configuration, an attacker could execute code as
the user running Apache, usually "apache".

Workaround
==========

A server should not be vulnerable if it is not using both mod_ssl and
mod_proxy. Otherwise there is no workaround other than to disable
mod_ssl.

Resolution
==========

All mod_ssl users should upgrade to the latest version:

    # emerge sync

    # emerge -pv ">=net-www/mod_ssl-2.8.19"
    # emerge ">=net-www/mod_ssl-2.8.19"

References
==========

  [ 1 ] mod_ssl Announcement
        http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749&w=2

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

    http://security.gentoo.org/glsa/glsa-200407-18.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

Attachment: _bin
Description: