Message-Id: <E1NHgnd-00045R-S1@titan.mandriva.com>
Date: Mon, 07 Dec 2009 17:51:01 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:323 ] apache


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:323
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : apache
 Date    : December 7, 2009
 Affected: 2008.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in apache:
 
 Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c
 in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to
 cause a denial of service (memory consumption) via multiple calls, as
 demonstrated by initial SSL client handshakes to the Apache HTTP Server
 mod_ssl that specify a compression algorithm (CVE-2008-1678). Note
 that this security issue does not really apply as zlib compression
 is not enabled in the openssl build provided by Mandriva, but apache
 is patched to address this issue anyway (conserns 2008.1 only).
 
 mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server
 2.2.11 allows remote attackers to obtain sensitive response data,
 intended for a client that sent an earlier POST request with no
 request body, via an HTTP request (CVE-2009-1191).
 
 Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the
 mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c
 in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions,
 allows remote attackers to inject arbitrary web script or HTML via
 wildcards in a pathname in an FTP URI (CVE-2008-2939). Note that this
 security issue was initially addressed with MDVSA-2008:195 but the
 patch fixing the issue was added but not applied in 2009.0.
 
 The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not
 properly handle Options=IncludesNOEXEC in the AllowOverride directive,
 which allows local users to gain privileges by configuring (1) Options
 Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a
 .htaccess file, and then inserting an exec element in a .shtml file
 (CVE-2009-1195).
 
 The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy
 module in the Apache HTTP Server before 2.3.3, when a reverse proxy
 is configured, does not properly handle an amount of streamed data
 that exceeds the Content-Length value, which allows remote attackers
 to cause a denial of service (CPU consumption) via crafted requests
 (CVE-2009-1890).
 
 Fix a potential Denial-of-Service attack against mod_deflate or other
 modules, by forcing the server to consume CPU time in compressing a
 large file after a client disconnects (CVE-2009-1891).
 
 The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in
 the mod_proxy_ftp module in the Apache HTTP Server 2.0.63 and 2.2.13
 allows remote FTP servers to cause a denial of service (NULL pointer
 dereference and child process crash) via a malformed reply to an EPSV
 command (CVE-2009-3094).
 
 The mod_proxy_ftp module in the Apache HTTP Server allows remote
 attackers to bypass intended access restrictions and send arbitrary
 commands to an FTP server via vectors related to the embedding of these
 commands in the Authorization HTTP header, as demonstrated by a certain
 module in VulnDisco Pack Professional 8.11.  NOTE: as of 20090903,
 this disclosure has no actionable information. However, because the
 VulnDisco Pack author is a reliable researcher, the issue is being
 assigned a CVE identifier for tracking purposes (CVE-2009-3095).
 
 Apache is affected by SSL injection or man-in-the-middle attacks
 due to a design flaw in the SSL and/or TLS protocols. A short term
 solution was released Sat Nov 07 2009 by the ASF team to mitigate
 these problems. Apache will now reject in-session renegotiation
 (CVE-2009-3555).
 
 Packages for 2008.0 are being provided due to extended support for
 Corporate products.
 
 This update provides a solution to these vulnerabilities.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1678
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1191
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1195
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3094
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3095
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
 http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 dd2bebdd6726d2d865331d37068a90b7  2008.0/i586/apache-base-2.2.6-8.3mdv2008.0.i586.rpm
 6de9d36a91b125cc03bafe911b7a38a2  2008.0/i586/apache-devel-2.2.6-8.3mdv2008.0.i586.rpm
 ab7963efad1b7951c94a24075a2070e7  2008.0/i586/apache-htcacheclean-2.2.6-8.3mdv2008.0.i586.rpm
 42a53b597d5547fb88b7427cacd617a1  2008.0/i586/apache-mod_authn_dbd-2.2.6-8.3mdv2008.0.i586.rpm
 1dff9d313e93c94e907d8c72348ed2e0  2008.0/i586/apache-mod_cache-2.2.6-8.3mdv2008.0.i586.rpm
 b575ede2978ad47e41d355bd8b192725  2008.0/i586/apache-mod_dav-2.2.6-8.3mdv2008.0.i586.rpm
 8ff3dee24d2d2d9a8d13e567cf1eaced  2008.0/i586/apache-mod_dbd-2.2.6-8.3mdv2008.0.i586.rpm
 7bae541dfec14b21700878514750de83  2008.0/i586/apache-mod_deflate-2.2.6-8.3mdv2008.0.i586.rpm
 19cab766a26ce53bd7e7973ed92f0db4  2008.0/i586/apache-mod_disk_cache-2.2.6-8.3mdv2008.0.i586.rpm
 a1336e4ab4f282c388d7565bde4557fd  2008.0/i586/apache-mod_file_cache-2.2.6-8.3mdv2008.0.i586.rpm
 6b2f2eb949977349390fa3b06cf257e7  2008.0/i586/apache-mod_ldap-2.2.6-8.3mdv2008.0.i586.rpm
 3640bbef5262ec0407126e31dd5ddde3  2008.0/i586/apache-mod_mem_cache-2.2.6-8.3mdv2008.0.i586.rpm
 98793747365606baabc08f22e36a0a04  2008.0/i586/apache-mod_proxy-2.2.6-8.3mdv2008.0.i586.rpm
 d7fe4d88f25d2a01b0809ab5292b0999  2008.0/i586/apache-mod_proxy_ajp-2.2.6-8.3mdv2008.0.i586.rpm
 4c9f48adbd0b1d45a874f06b9275ebe3  2008.0/i586/apache-mod_ssl-2.2.6-8.3mdv2008.0.i586.rpm
 e5a1d9476316ccc9f183cb1ae5bbcf31  2008.0/i586/apache-modules-2.2.6-8.3mdv2008.0.i586.rpm
 44f7810695a40519c68930695829f124  2008.0/i586/apache-mod_userdir-2.2.6-8.3mdv2008.0.i586.rpm
 d6f666e9954422664d1f029fc147b591  2008.0/i586/apache-mpm-event-2.2.6-8.3mdv2008.0.i586.rpm
 75e205ddbc9313b8d02519e57919923a  2008.0/i586/apache-mpm-itk-2.2.6-8.3mdv2008.0.i586.rpm
 6d68e8fa7baccc2ad090c703fb33458e  2008.0/i586/apache-mpm-prefork-2.2.6-8.3mdv2008.0.i586.rpm
 331f18ce48403472fc7f8af6d5daee8e  2008.0/i586/apache-mpm-worker-2.2.6-8.3mdv2008.0.i586.rpm
 c75e69bcabc104938cb9033e591d1de8  2008.0/i586/apache-source-2.2.6-8.3mdv2008.0.i586.rpm 
 23fcdf29e21b0146fb5646baca2fa63b  2008.0/SRPMS/apache-2.2.6-8.3mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 3d4afe3f8da8369d80b6c195e132c5c0  2008.0/x86_64/apache-base-2.2.6-8.3mdv2008.0.x86_64.rpm
 37034ee7c7eb813de2a00a6945a10248  2008.0/x86_64/apache-devel-2.2.6-8.3mdv2008.0.x86_64.rpm
 ba296f9aa229a616a2c406d1a16912c3  2008.0/x86_64/apache-htcacheclean-2.2.6-8.3mdv2008.0.x86_64.rpm
 77fa75d36e7a4bbe154c846e3271e7a3  2008.0/x86_64/apache-mod_authn_dbd-2.2.6-8.3mdv2008.0.x86_64.rpm
 ca29e2db08b29e319f2392b46ea4c3fe  2008.0/x86_64/apache-mod_cache-2.2.6-8.3mdv2008.0.x86_64.rpm
 3fbf5a0276adaa2d887a92482d81313f  2008.0/x86_64/apache-mod_dav-2.2.6-8.3mdv2008.0.x86_64.rpm
 9c66e471c2d2d3e43462302d0cc6f1c9  2008.0/x86_64/apache-mod_dbd-2.2.6-8.3mdv2008.0.x86_64.rpm
 05020102a26a28b96319b23e3b6e43d6  2008.0/x86_64/apache-mod_deflate-2.2.6-8.3mdv2008.0.x86_64.rpm
 7191542417b30ed77334f1b8366628aa  2008.0/x86_64/apache-mod_disk_cache-2.2.6-8.3mdv2008.0.x86_64.rpm
 f4177dbdcfd2e3dc8e66be731ad731c4  2008.0/x86_64/apache-mod_file_cache-2.2.6-8.3mdv2008.0.x86_64.rpm
 fea417664f0a2689fa12308bd80c2fe4  2008.0/x86_64/apache-mod_ldap-2.2.6-8.3mdv2008.0.x86_64.rpm
 9cf956fa426e6bdf6497337b6e26a2ab  2008.0/x86_64/apache-mod_mem_cache-2.2.6-8.3mdv2008.0.x86_64.rpm
 0d9d04ca878bb3f19f4764152da42d82  2008.0/x86_64/apache-mod_proxy-2.2.6-8.3mdv2008.0.x86_64.rpm
 dbbcd75dd83779f54f98fa3e16b59f13  2008.0/x86_64/apache-mod_proxy_ajp-2.2.6-8.3mdv2008.0.x86_64.rpm
 dce8db6742ba28a71e18b86bb38688c8  2008.0/x86_64/apache-mod_ssl-2.2.6-8.3mdv2008.0.x86_64.rpm
 2ff69d6e9c2cd3250f6746d4a7d921fd  2008.0/x86_64/apache-modules-2.2.6-8.3mdv2008.0.x86_64.rpm
 f298827d4dfa631a77907f7f5733fa29  2008.0/x86_64/apache-mod_userdir-2.2.6-8.3mdv2008.0.x86_64.rpm
 6f02fb080e308ca0826fdb1ef00a1489  2008.0/x86_64/apache-mpm-event-2.2.6-8.3mdv2008.0.x86_64.rpm
 b886d30d73c60a515b3ed36d7f186378  2008.0/x86_64/apache-mpm-itk-2.2.6-8.3mdv2008.0.x86_64.rpm
 62d7754a5aa7af596cc06cd540d4025f  2008.0/x86_64/apache-mpm-prefork-2.2.6-8.3mdv2008.0.x86_64.rpm
 d3438e0967978e580be896bd85f1d953  2008.0/x86_64/apache-mpm-worker-2.2.6-8.3mdv2008.0.x86_64.rpm
 e72af335ec7c3c02b5a494fbd6e99e0e  2008.0/x86_64/apache-source-2.2.6-8.3mdv2008.0.x86_64.rpm 
 23fcdf29e21b0146fb5646baca2fa63b  2008.0/SRPMS/apache-2.2.6-8.3mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLHQcamqjQ0CJFipgRAsJgAKDf5oc5UbEz3j+qsMn3tL6F8cujygCfY+cu
MUj4lK2Wsb+qzbv2V+Ih30U=
=VdZS
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists