Full Disclosure mailing list archives
[ GLSA 200509-12 ] Apache, mod_ssl: Multiple vulnerabilities
From: koon () gentoo org
Date: Mon, 19 Sep 2005 13:27:39 -0400
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200509-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Apache, mod_ssl: Multiple vulnerabilities Date: September 19, 2005 Bugs: #103554, #104807 ID: 200509-12 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== mod_ssl and Apache are vulnerable to a restriction bypass and a potential local privilege escalation. Background ========== The Apache HTTP server is one of the most popular web servers on the Internet. mod_ssl provides SSL v2/v3 and TLS v1 support for Apache 1.3 and is also included in Apache 2. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-www/mod_ssl < 2.8.24 >= 2.8.24 2 net-www/apache < 2.0.54-r15 >= 2.0.54-r15 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description =========== mod_ssl contains a security issue when "SSLVerifyClient optional" is configured in the global virtual host configuration (CAN-2005-2700). Also, Apache's httpd includes a PCRE library, which makes it vulnerable to an integer overflow (CAN-2005-2491). Impact ====== Under a specific configuration, mod_ssl does not properly enforce the client-based certificate authentication directive, "SSLVerifyClient require", in a per-location context, which could be potentially used by a remote attacker to bypass some restrictions. By creating a specially crafted ".htaccess" file, a local attacker could possibly exploit Apache's vulnerability, which would result in a local privilege escalation. Workaround ========== There is no known workaround at this time. Resolution ========== All mod_ssl users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-www/mod_ssl-2.8.24" All Apache 2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-www/apache-2.0.54-r15" References ========== [ 1 ] CAN-2005-2491 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491 [ 2 ] CAN-2005-2700 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200509-12.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0
Attachment:
2#signature.asc
Description:
Attachment:
GWAVADAT.TXT
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [ GLSA 200509-12 ] Apache, mod_ssl: Multiple vulnerabilities Thierry Carrez (Sep 19)
- <Possible follow-ups>
- [ GLSA 200509-12 ] Apache, mod_ssl: Multiple vulnerabilities koon (Sep 19)