Full Disclosure mailing list archives
[TURBOLINUX SECURITY INFO] 18/Nov/2004
From: Turbolinux <security-announce () turbolinux co jp>
Date: Thu, 18 Nov 2004 21:22:28 +0900
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is an announcement only email list for the x86 architecture. ============================================================ Turbolinux Security Announcement 18/Nov/2004 ============================================================ The following page contains the security information of Turbolinux Inc. - Turbolinux Security Center http://www.turbolinux.com/security/ (1) apache -> Multiple vulnerabilities exist in Apache =========================================================== * apache -> Multiple vulnerabilities exist in Apache =========================================================== More information : Apache is a powerful, full-featured, efficient, and freely-available Web server. - A buffer overflow vulnerability has been found in Apache's mod_proxy module exploitable via malformed Content-Length headers. - A buffer overflow vulnerability has been found in Apache's mod_include module -- in its get_tag() function. Impact : The mod_proxy vulnerability may allow an attacker to cause a denial of service of httpd. A local user could exploit the mod_include vulnerability to gain apache user privileges. Affected Products : - Turbolinux Appliance Server 1.0 Hosting Edition - Turbolinux Appliance Server 1.0 Workgroup Edition - Turbolinux 8 Server - Turbolinux 8 Workstation - Turbolinux 7 Server - Turbolinux 7 Workstation Solution : Please use the turbopkg (zabom) tool to apply the necessary updates. --------------------------------------------- # turbopkg or # zabom update apache apache-devel apache-manual mod_ssl --------------------------------------------- <Turbolinux Appliance Server 1.0 Hosting Edition> Source Packages Size : MD5 apache-1.3.27-26.src.rpm 3107759 dca2cbcbcde45ff80d9a611da567a323 Binary Packages Size : MD5 apache-1.3.27-26.i586.rpm 501255 c01a92b78bdb6304d42af3c520ac565c apache-devel-1.3.27-26.i586.rpm 94281 2393aa5cdc3e5bf56212583470433530 mod_ssl-2.8.14-26.i586.rpm 181280 c679e28a0062cbff7460244ff51fd239 <Turbolinux Appliance Server 1.0 Workgroup Edition> Source Packages Size : MD5 apache-1.3.27-26.src.rpm 3107759 43506d1d374a0505ea9c65916a6fd177 Binary Packages Size : MD5 apache-1.3.27-26.i586.rpm 501454 2732c823c39c95a2a15043b40c8902a6 apache-devel-1.3.27-26.i586.rpm 94428 ac1dfc6beab6ab504d22f3b95dc595a0 mod_ssl-2.8.14-26.i586.rpm 181440 a3b4a8d050d92fda633570759f3b2353 <Turbolinux 8 Server> Source Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/apache-1.3.27-26.src.rpm 3107759 fd508c9f43f4134fdeded2d30a6c0e5e Binary Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-1.3.27-26.i586.rpm 501420 849a894023c4a1cf8c926d22689a7c5d ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-devel-1.3.27-26.i586.rpm 94414 16e16de1872458241e27bca670041ba2 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-manual-1.3.27-26.i586.rpm 850317 0a66500f4a483d8464f582c3eb7b8548 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm 181339 343ca76f7bab970a1eafdf4398e12b19 <Turbolinux 8 Workstation> Source Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/apache-1.3.27-26.src.rpm 3107759 7ac11746242fc78fc9ad947485f0287a Binary Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-1.3.27-26.i586.rpm 501457 2f1382d3830c2f6eb5d21134b543432a ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-devel-1.3.27-26.i586.rpm 94438 47fb045028f3cea6c3caf48d8a6f8e28 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-manual-1.3.27-26.i586.rpm 850603 24d104b2bdf1f16c086437cd2d658236 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm 181484 addb510be59954f4409b91d68a7a83ed <Turbolinux 7 Server> Source Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/apache-1.3.27-26.src.rpm 3107759 c80c339996c32883d422131571e78c69 Binary Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-1.3.27-26.i586.rpm 488342 1fbc2d00ce603a467fd50571ba25a955 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-devel-1.3.27-26.i586.rpm 94568 357bf535d26753f92e230b4fdabff5f2 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-manual-1.3.27-26.i586.rpm 850473 874d0be136ee68e1be68095763b4c061 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm 179136 155a112ff31f5ccdd0df45f1754dad8b <Turbolinux 7 Workstation> Source Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/apache-1.3.27-26.src.rpm 3107759 989fb815769836ff9a8608bafb825fa1 Binary Packages Size : MD5 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-1.3.27-26.i586.rpm 488502 e8230258d2166b85c90e1b730ce9464c ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-devel-1.3.27-26.i586.rpm 94591 46d98d78565671e55b3430de3e2be286 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-manual-1.3.27-26.i586.rpm 850609 69c918c305aeef366624df51841d5546 ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm 179072 05ea943efebee1781dbabb1de2b2af26 Notice : After performing the update, it is necessary to restart the httpd daemon. To do this, run the following command as user root. --------------------------------------------- # /etc/init.d/httpd restart or # /etc/rc.d/init.d/httpd restart --------------------------------------------- References: CVE [CAN-2004-0492] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492 [CAN-2004-0940] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940 * You may need to update the turbopkg tool before applying the update. Please refer to the following URL for detailed information. http://www.turbolinux.com/download/zabom.html http://www.turbolinux.com/download/zabomupdate.html Package Update Path http://www.turbolinux.com/update ============================================================ * To obtain the public key Here is the public key http://www.turbolinux.com/security/ * To unsubscribe from the list If you ever want to remove yourself from this mailing list, you can send a message to <server-users-e-ctl () turbolinux co jp> with the word `unsubscribe' in the body (don't include the quotes). unsubscribe * To change your email address If you ever want to chage email address in this mailing list, you can send a message to <server-users-e-ctl () turbolinux co jp> with the following command in the message body: chaddr 'old address' 'new address' If you have any questions or problems, please contact <supp_info () turbolinux co jp> Thank you! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFBnJQJK0LzjOqIJMwRAhZTAKCo0/O8tB5JzxrIbJ6+HpOGz2MIWwCdGqpk VnG9l5pRI3AZymJcCg2rK4k= =Bv9g -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [TURBOLINUX SECURITY INFO] 18/Nov/2004 Turbolinux (Nov 18)