lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: security at (EnGarde Secure Linux)
Subject: [ESA-20021007-024] apache: potential DoS, cross-site scripting, and
 buffer overflow vulnerabilities.

Hash: SHA1

| EnGarde Secure Linux Security Advisory                October 07, 2002 |
|                          ESA-20021007-024 |
|                                                                        |
| Package: apache                                                        |
| Summary: potential DoS, cross-site scripting, and buffer overflow      |
|          vulnerabilities.                                              |

  EnGarde Secure Linux is a secure distribution of Linux that features
  improved access control, host and network intrusion detection, Web
  based secure remote management, complete e-commerce using AllCommerce,
  and integrated open source security tools.

- --------
  This update fixes the following vulnerabilities in the Apache package:

    * CAN-2002-0839
      The shared memory scoreboard in the HTTP daemon for Apache 1.3.x
      before 1.3.27 allows any user running as the Apache UID to send a
      SIGUSR1 signal to any process as root, resulting in a denial of
      service (process kill) or possibly other behaviors that would not
      normally be allowed, by modifying the parent[].pid and
      parent[].last_rtime segments in the scoreboard.

    * CAN-2002-0840
      Cross-site scripting (XSS) vulnerability in the default error page
      of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when
      UseCanonicalName is "Off" and support for wildcard DNS is present,
      allows remote attackers to execute script as other web page visitors
      via the Host: header.

    * CAN-2002-0843
      Buffer overflows in the ApacheBench support program (ab.c) in Apache
      before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web
      server to cause a denial of service and possibly execute arbitrary
      code via a long response.

  The Common Vulnerabilities and Exposures project may be found at

- --------
  Users of the EnGarde Professional edition can use the Guardian Digital
  Secure Network to update their systems automatically.

  EnGarde Community users should upgrade to the most recent version
  as outlined in this advisory.  Updates may be obtained from:

  Before upgrading the package, the machine must either:

    a) be booted into a "standard" kernel; or
    b) have LIDS disabled.

  To disable LIDS, execute the command:

    # /sbin/lidsadm -S -- -LIDS_GLOBAL

  To install the updated package, execute the command:

    # rpm -Uvh files

  You must now update the LIDS configuration by executing the command:

    # /usr/sbin/

  To re-enable LIDS (if it was disabled), execute the command:

    # /sbin/lidsadm -S -- +LIDS_GLOBAL

  To verify the signatures of the updated packages, execute the command:

    # rpm -Kv files

- ----------------
  These updated packages are for EnGarde Secure Linux Community

  Source Packages:

      MD5 Sum: 2c98864bb3be1ebf77a9c227cc15100a

  Binary Packages:

      MD5 Sum: 63b00c465bb617f3e08a04154a8ffea7

      MD5 Sum: aa9ed8ab148de56f696ee6f2a52a5f77

- ----------
  Guardian Digital's public key:

  Apache's Official Web Site:

  Security Contact:
  EnGarde Advisories:

- --------------------------------------------------------------------------
$Id: ESA-20021007-024-apache,v 1.2 2002/10/07 17:39:21 rwm Exp $
- --------------------------------------------------------------------------
Author: Ryan W. Maple <> 
Copyright 2002, Guardian Digital, Inc.

Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see


     To unsubscribe email
         with "unsubscribe" in the subject of the message.

Copyright(c) 2001 Guardian Digital, Inc.      

Powered by blists - more mailing lists