full-disclosure - [ GLSA 200409-33 ] Apache: Exposure of protected directories

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200409240100.51753.krispykringle@gentoo.org>
From: krispykringle at gentoo.org (Dan Margolis)
Subject: [ GLSA 200409-33 ] Apache: Exposure of protected directories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200409-33
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Low
     Title: Apache: Exposure of protected directories
      Date: September 24, 2004
      Bugs: #64804
        ID: 200409-33

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

A bug in the way Apache handles the Satisfy directive can lead to the
exposure of protected directories to unauthorized users.

Background
==========

The Apache HTTP server is one of most popular web servers on the
Internet.

Affected packages
=================

    -------------------------------------------------------------------
     Package         /  Vulnerable  /                       Unaffected
    -------------------------------------------------------------------
  1  net-www/apache      == 2.0.51                        >= 2.0.51-r1
                                                              < 2.0.51

Description
===========

A bug in the way Apache handles the Satisfy directive, which is used to
require that certain conditions (client host, client authentication,
etc) be met before access to a certain directory is granted, could
allow the exposure of protected directories to unauthorized clients.

Impact
======

Directories containing protected data could be exposed to all visitors
to the webserver.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Apache users should upgrade to the latest version:

    # emerge sync

    # emerge -pv ">=net-www/apache-2.0.51-r1"
    # emerge ">=net-www/apache-2.0.51-r1"

References
==========

  [ 1 ] Apache Bug #31315
        http://issues.apache.org/bugzilla/show_bug.cgi?id=31315
  [ 2 ] CAN-2004-0811
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0811

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200409-33.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@...too.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iQEVAwUBQVOp/rDO2aFJ9pv2AQK24AgAiJADMeOT2uXgD3/95J2BOjPANZNFU4gJ
RS6lBrw2VuVe4urwkjPoNjlqlM/4BDY2BiXJkuCYNvKvMIm8YuYTkEtDstSKujA8
JVfSg18MeROAQqyS0sNQ9IOhr4nV3DoX60Omczp+8l3ZKtge+MUvHKiPJJPv0nuK
3cLMw7uKr/ymZatXcIDkOG1rm7K/fPMLXoVzH1aIyyDhiOspJMjku9jVm5RB9ZAe
3bK4aniPpJGpoXRIu/2kZXDI/kGTgqsCaE8ajAWU7M4mYHAheOQ0CwJguRrqVqBU
MWA1Vgn69ElQCueTD6tCznMm1RD9FxOhwoHx2Xf7H8NH6gZJc2aFMQ==
=jUsS
-----END PGP SIGNATURE-----