| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <200411182122.38471.security-announce@turbolinux.co.jp>
From: security-announce at turbolinux.co.jp (Turbolinux)
Subject: [TURBOLINUX SECURITY INFO] 18/Nov/2004
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
This is an announcement only email list for the x86 architecture.
============================================================
Turbolinux Security Announcement 18/Nov/2004
============================================================
The following page contains the security information of Turbolinux Inc.
- Turbolinux Security Center
http://www.turbolinux.com/security/
(1) apache -> Multiple vulnerabilities exist in Apache
===========================================================
* apache -> Multiple vulnerabilities exist in Apache
===========================================================
More information :
Apache is a powerful, full-featured, efficient, and freely-available
Web server.
- A buffer overflow vulnerability has been found in Apache's mod_proxy
module exploitable via malformed Content-Length headers.
- A buffer overflow vulnerability has been found in Apache's mod_include
module -- in its get_tag() function.
Impact :
The mod_proxy vulnerability may allow an attacker to cause a denial of
service of httpd.
A local user could exploit the mod_include vulnerability to gain apache
user privileges.
Affected Products :
- Turbolinux Appliance Server 1.0 Hosting Edition
- Turbolinux Appliance Server 1.0 Workgroup Edition
- Turbolinux 8 Server
- Turbolinux 8 Workstation
- Turbolinux 7 Server
- Turbolinux 7 Workstation
Solution :
Please use the turbopkg (zabom) tool to apply the necessary updates.
---------------------------------------------
# turbopkg
or
# zabom update apache apache-devel apache-manual mod_ssl
---------------------------------------------
<Turbolinux Appliance Server 1.0 Hosting Edition>
Source Packages
Size : MD5
apache-1.3.27-26.src.rpm
3107759 dca2cbcbcde45ff80d9a611da567a323
Binary Packages
Size : MD5
apache-1.3.27-26.i586.rpm
501255 c01a92b78bdb6304d42af3c520ac565c
apache-devel-1.3.27-26.i586.rpm
94281 2393aa5cdc3e5bf56212583470433530
mod_ssl-2.8.14-26.i586.rpm
181280 c679e28a0062cbff7460244ff51fd239
<Turbolinux Appliance Server 1.0 Workgroup Edition>
Source Packages
Size : MD5
apache-1.3.27-26.src.rpm
3107759 43506d1d374a0505ea9c65916a6fd177
Binary Packages
Size : MD5
apache-1.3.27-26.i586.rpm
501454 2732c823c39c95a2a15043b40c8902a6
apache-devel-1.3.27-26.i586.rpm
94428 ac1dfc6beab6ab504d22f3b95dc595a0
mod_ssl-2.8.14-26.i586.rpm
181440 a3b4a8d050d92fda633570759f3b2353
<Turbolinux 8 Server>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/apache-1.3.27-26.src.rpm
3107759 fd508c9f43f4134fdeded2d30a6c0e5e
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-1.3.27-26.i586.rpm
501420 849a894023c4a1cf8c926d22689a7c5d
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
94414 16e16de1872458241e27bca670041ba2
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
850317 0a66500f4a483d8464f582c3eb7b8548
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
181339 343ca76f7bab970a1eafdf4398e12b19
<Turbolinux 8 Workstation>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/apache-1.3.27-26.src.rpm
3107759 7ac11746242fc78fc9ad947485f0287a
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-1.3.27-26.i586.rpm
501457 2f1382d3830c2f6eb5d21134b543432a
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
94438 47fb045028f3cea6c3caf48d8a6f8e28
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
850603 24d104b2bdf1f16c086437cd2d658236
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
181484 addb510be59954f4409b91d68a7a83ed
<Turbolinux 7 Server>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/apache-1.3.27-26.src.rpm
3107759 c80c339996c32883d422131571e78c69
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-1.3.27-26.i586.rpm
488342 1fbc2d00ce603a467fd50571ba25a955
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
94568 357bf535d26753f92e230b4fdabff5f2
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
850473 874d0be136ee68e1be68095763b4c061
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
179136 155a112ff31f5ccdd0df45f1754dad8b
<Turbolinux 7 Workstation>
Source Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/apache-1.3.27-26.src.rpm
3107759 989fb815769836ff9a8608bafb825fa1
Binary Packages
Size : MD5
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-1.3.27-26.i586.rpm
488502 e8230258d2166b85c90e1b730ce9464c
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
94591 46d98d78565671e55b3430de3e2be286
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
850609 69c918c305aeef366624df51841d5546
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
179072 05ea943efebee1781dbabb1de2b2af26
Notice :
After performing the update, it is necessary to restart the httpd daemon.
To do this, run the following command as user root.
---------------------------------------------
# /etc/init.d/httpd restart
or
# /etc/rc.d/init.d/httpd restart
---------------------------------------------
References:
CVE
[CAN-2004-0492]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492
[CAN-2004-0940]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940
* You may need to update the turbopkg tool before applying the update.
Please refer to the following URL for detailed information.
http://www.turbolinux.com/download/zabom.html
http://www.turbolinux.com/download/zabomupdate.html
Package Update Path
http://www.turbolinux.com/update
============================================================
* To obtain the public key
Here is the public key
http://www.turbolinux.com/security/
* To unsubscribe from the list
If you ever want to remove yourself from this mailing list,
you can send a message to <server-users-e-ctl@...bolinux.co.jp> with
the word `unsubscribe' in the body (don't include the quotes).
unsubscribe
* To change your email address
If you ever want to chage email address in this mailing list,
you can send a message to <server-users-e-ctl@...bolinux.co.jp> with
the following command in the message body:
chaddr 'old address' 'new address'
If you have any questions or problems, please contact
<supp_info@...bolinux.co.jp>
Thank you!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
iD8DBQFBnJQJK0LzjOqIJMwRAhZTAKCo0/O8tB5JzxrIbJ6+HpOGz2MIWwCdGqpk
VnG9l5pRI3AZymJcCg2rK4k=
=Bv9g
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists