Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2002.696 -- RHSA-2002:222-21
Updated apache, httpd, and mod_ssl packages available
13 December 2002
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: apache
httpd
mod_ssl
Vendor: Red Hat
Operating System: Red Hat Linux 6.2
Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
Platform: Alpha
i386
SPARC
IA-64
Impact: Denial of Service
Execute Arbitrary Code/Commands
Access Required: Remote
- --------------------------BEGIN INCLUDED TEXT--------------------
- ---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Updated apache, httpd, and mod_ssl packages available
Advisory ID: RHSA-2002:222-21
Issue date: 2002-12-12
Updated on: 2002-11-25
Product: Red Hat Linux
Keywords: apache ab mod_ssl xss scoreboard
Cross references:
Obsoletes: RHSA-2002:103
CVE Names: CAN-2002-0839 CAN-2002-0840 CAN-2002-0843 CAN-2002-1157
- ---------------------------------------------------------------------
1. Topic:
Updated apache and httpd packages which fix a number of security issues are
now available for Red Hat Linux 6.2, 7, 7.1, 7.2, 7.3, and 8.0.
2. Relevant releases/architectures:
Red Hat Linux 6.2 - alpha, i386, sparc
Red Hat Linux 7.0 - alpha, i386
Red Hat Linux 7.1 - alpha, i386, ia64
Red Hat Linux 7.2 - i386, ia64
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
3. Problem description:
The Apache HTTP Web Server is a secure, efficient, and extensible web
server that provides HTTP services.
Buffer overflows in the ApacheBench support program (ab.c) in Apache
versions prior to 1.3.27, and Apache versions 2.x prior to 2.0.43, allow a
malicious Web server to cause a denial of service (DoS) and possibly
execute arbitrary code via a long response. The Common Vulnerabilities and
Exposures project has assigned the name CAN-2002-0843 to this issue.
Two cross-site scripting (XSS) vulnerabilities are present in the error
pages for the default "404 Not Found" error and for the error response
when a plain HTTP request is received on an SSL port. Both of these issues
are only exploitable if the "UseCanonicalName" setting has been changed to
"Off", and wildcard DNS is in use. These issues could allow remote
attackers to execute scripts as other webpage visitors, for instance, to
steal cookies. These issues affect versions of Apache 1.3 before 1.3.26,
versions of Apache 2.0 before 2.0.43, and versions of mod_ssl before
2.8.12. (CAN-2002-0840, CAN-2002-1157)
The shared memory scoreboard in the HTTP daemon for Apache 1.3, prior to
version 1.3.27, allows a user running as the "apache" UID to send a
SIGUSR1 signal to any process as root, resulting in a denial of service
(process kill) or other such behavior that would not normally be allowed.
(CAN-2002-0839). Note that this issue does not affect Red Hat
Linux 8.0.
All users of the Apache HTTP Web Server are advised to upgrade to the
applicable errata packages. For Red Hat Linux 6.2, 7, 7.1, 7.2, and 7.3,
these packages include Apache version 1.3.27 which is not vulnerable to
these issues. For Red Hat Linux 8.0, the fixes have been back-ported and
applied to Apache version 2.0.40.
Note that the instructions in the "Solution" section of this errata contain
additional steps required to complete the upgrade process.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.
Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
After the errata packages are installed, restart the Web service by running
the following command:
/sbin/service httpd restart
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
74882 - XSS vulnerabilities
76327 - Apache 1.3.27 released fixing multiple security issues
6. RPMs required:
Red Hat Linux 6.2:
SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/apache-1.3.27-1.6.2.src.rpm
alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/apache-1.3.27-1.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/apache-devel-1.3.27-1.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/apache-manual-1.3.27-1.6.2.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/en/os/i386/apache-1.3.27-1.6.2.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/apache-devel-1.3.27-1.6.2.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/apache-manual-1.3.27-1.6.2.i386.rpm
sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/apache-1.3.27-1.6.2.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/apache-devel-1.3.27-1.6.2.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/apache-manual-1.3.27-1.6.2.sparc.rpm
Red Hat Linux 7.0:
SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/apache-1.3.27-1.7.1.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/mod_ssl-2.8.12-1.7.src.rpm
alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/apache-1.3.27-1.7.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/apache-devel-1.3.27-1.7.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/apache-manual-1.3.27-1.7.1.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/mod_ssl-2.8.12-1.7.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/en/os/i386/apache-1.3.27-1.7.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/apache-devel-1.3.27-1.7.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/apache-manual-1.3.27-1.7.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/mod_ssl-2.8.12-1.7.i386.rpm
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/apache-1.3.27-1.7.1.src.rpm
ftp://updates.redhat.com/7.1/en/os/SRPMS/mod_ssl-2.8.12-1.7.src.rpm
alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/apache-1.3.27-1.7.1.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/apache-devel-1.3.27-1.7.1.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/apache-manual-1.3.27-1.7.1.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/mod_ssl-2.8.12-1.7.alpha.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/apache-1.3.27-1.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/apache-devel-1.3.27-1.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/apache-manual-1.3.27-1.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/mod_ssl-2.8.12-1.7.i386.rpm
ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/apache-1.3.27-1.7.1.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/apache-devel-1.3.27-1.7.1.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/apache-manual-1.3.27-1.7.1.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/mod_ssl-2.8.12-1.7.ia64.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/apache-1.3.27-1.7.2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/mod_ssl-2.8.12-2.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/apache-1.3.27-1.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/apache-devel-1.3.27-1.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/apache-manual-1.3.27-1.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/mod_ssl-2.8.12-2.i386.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/apache-1.3.27-1.7.2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/apache-devel-1.3.27-1.7.2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/apache-manual-1.3.27-1.7.2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/mod_ssl-2.8.12-2.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/apache-1.3.27-2.src.rpm
ftp://updates.redhat.com/7.3/en/os/SRPMS/mod_ssl-2.8.12-2.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/apache-1.3.27-2.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/apache-devel-1.3.27-2.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/apache-manual-1.3.27-2.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mod_ssl-2.8.12-2.i386.rpm
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/httpd-2.0.40-11.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/httpd-2.0.40-11.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/httpd-devel-2.0.40-11.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/httpd-manual-2.0.40-11.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/mod_ssl-2.0.40-11.i386.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
941bd10cf20ffb98e05b6b62eb868ac6 6.2/en/os/SRPMS/apache-1.3.27-1.6.2.src.rpm
2a13bd7501151a73bf307f5d5501ed9e 6.2/en/os/alpha/apache-1.3.27-1.6.2.alpha.rpm
21673918d3e0ab20ff2d2c214d3512d7 6.2/en/os/alpha/apache-devel-1.3.27-1.6.2.alpha.rpm
a0179b768549d18cb3247942846a7e83 6.2/en/os/alpha/apache-manual-1.3.27-1.6.2.alpha.rpm
1e3b0db6a15b806d73ae068374be7059 6.2/en/os/i386/apache-1.3.27-1.6.2.i386.rpm
62bfe25eacbccab63c7c1ec7823b1a0c 6.2/en/os/i386/apache-devel-1.3.27-1.6.2.i386.rpm
7de68537d0bfdd3c5276c7a26c10fb86 6.2/en/os/i386/apache-manual-1.3.27-1.6.2.i386.rpm
bf83e969b350c3bde5d5c637f6d97d4e 6.2/en/os/sparc/apache-1.3.27-1.6.2.sparc.rpm
1845941d496068449d918ab125481994 6.2/en/os/sparc/apache-devel-1.3.27-1.6.2.sparc.rpm
0218ec56fda57c6518236915edad8fe3 6.2/en/os/sparc/apache-manual-1.3.27-1.6.2.sparc.rpm
a450f8cee1c9916d6c4662dd01791360 7.0/en/os/SRPMS/apache-1.3.27-1.7.1.src.rpm
cfb81a125517bc44e8382d249db1d7a9 7.0/en/os/SRPMS/mod_ssl-2.8.12-1.7.src.rpm
c7fc8714af3bde967998c0f39506ebf4 7.0/en/os/alpha/apache-1.3.27-1.7.1.alpha.rpm
c080c8c829aa670575612b1377951118 7.0/en/os/alpha/apache-devel-1.3.27-1.7.1.alpha.rpm
7d1d023e3981c3336e1225827bef138c 7.0/en/os/alpha/apache-manual-1.3.27-1.7.1.alpha.rpm
ffb847c9445946d5b7ad6c6226a7c559 7.0/en/os/alpha/mod_ssl-2.8.12-1.7.alpha.rpm
be954ca5a23c7a929a9cf53fa9901f8d 7.0/en/os/i386/apache-1.3.27-1.7.1.i386.rpm
cc14aa8ad1ad26fb870bf8d61a32d144 7.0/en/os/i386/apache-devel-1.3.27-1.7.1.i386.rpm
6136b6d40563a8df1b18fbd725caaf9e 7.0/en/os/i386/apache-manual-1.3.27-1.7.1.i386.rpm
994ae80126430f7c1c32fdc37856665c 7.0/en/os/i386/mod_ssl-2.8.12-1.7.i386.rpm
a450f8cee1c9916d6c4662dd01791360 7.1/en/os/SRPMS/apache-1.3.27-1.7.1.src.rpm
cfb81a125517bc44e8382d249db1d7a9 7.1/en/os/SRPMS/mod_ssl-2.8.12-1.7.src.rpm
c7fc8714af3bde967998c0f39506ebf4 7.1/en/os/alpha/apache-1.3.27-1.7.1.alpha.rpm
c080c8c829aa670575612b1377951118 7.1/en/os/alpha/apache-devel-1.3.27-1.7.1.alpha.rpm
7d1d023e3981c3336e1225827bef138c 7.1/en/os/alpha/apache-manual-1.3.27-1.7.1.alpha.rpm
ffb847c9445946d5b7ad6c6226a7c559 7.1/en/os/alpha/mod_ssl-2.8.12-1.7.alpha.rpm
be954ca5a23c7a929a9cf53fa9901f8d 7.1/en/os/i386/apache-1.3.27-1.7.1.i386.rpm
cc14aa8ad1ad26fb870bf8d61a32d144 7.1/en/os/i386/apache-devel-1.3.27-1.7.1.i386.rpm
6136b6d40563a8df1b18fbd725caaf9e 7.1/en/os/i386/apache-manual-1.3.27-1.7.1.i386.rpm
994ae80126430f7c1c32fdc37856665c 7.1/en/os/i386/mod_ssl-2.8.12-1.7.i386.rpm
f839f3628c96dd69598199c1f8ec5c20 7.1/en/os/ia64/apache-1.3.27-1.7.1.ia64.rpm
dfbb2a56685059e50facb5e214f0db89 7.1/en/os/ia64/apache-devel-1.3.27-1.7.1.ia64.rpm
db0cf12c6d9c4c79c874efe165a043f9 7.1/en/os/ia64/apache-manual-1.3.27-1.7.1.ia64.rpm
baabf87a3644eba5c9ed35c5f0d380b9 7.1/en/os/ia64/mod_ssl-2.8.12-1.7.ia64.rpm
fb310f9f6bdbef9015813c927f7a3aed 7.2/en/os/SRPMS/apache-1.3.27-1.7.2.src.rpm
cae24f57f879b6a61818ac8f10e853f0 7.2/en/os/SRPMS/mod_ssl-2.8.12-2.src.rpm
937277dd20dc1378abcd94f3f3aea90d 7.2/en/os/i386/apache-1.3.27-1.7.2.i386.rpm
616a8185b386c4e2fc2c302f80267437 7.2/en/os/i386/apache-devel-1.3.27-1.7.2.i386.rpm
1bdcb4382d32ccf8184b16bdebd11093 7.2/en/os/i386/apache-manual-1.3.27-1.7.2.i386.rpm
e83635604fb16d3d8bc5dd37b0afa0f4 7.2/en/os/i386/mod_ssl-2.8.12-2.i386.rpm
055f5ad5af3b1459c7ad327c37137f69 7.2/en/os/ia64/apache-1.3.27-1.7.2.ia64.rpm
6c35060e59e833f1bc4a760ca90d0654 7.2/en/os/ia64/apache-devel-1.3.27-1.7.2.ia64.rpm
c918d22e8a736f2bf59125b67297d140 7.2/en/os/ia64/apache-manual-1.3.27-1.7.2.ia64.rpm
11bfa3ba16c8cb8e2a9af4655284584a 7.2/en/os/ia64/mod_ssl-2.8.12-2.ia64.rpm
7ba20ebb306ecdd655ad8d5ce37af121 7.3/en/os/SRPMS/apache-1.3.27-2.src.rpm
cae24f57f879b6a61818ac8f10e853f0 7.3/en/os/SRPMS/mod_ssl-2.8.12-2.src.rpm
6eb4e656c5310116e0cccc4e09002d2c 7.3/en/os/i386/apache-1.3.27-2.i386.rpm
7990f8d8ed4846704e468c9390618731 7.3/en/os/i386/apache-devel-1.3.27-2.i386.rpm
c91ec30aaede3d3ed691dc83c6869a99 7.3/en/os/i386/apache-manual-1.3.27-2.i386.rpm
e83635604fb16d3d8bc5dd37b0afa0f4 7.3/en/os/i386/mod_ssl-2.8.12-2.i386.rpm
33769c1c143f43c234015fcacc06b3c0 8.0/en/os/SRPMS/httpd-2.0.40-11.src.rpm
f2e8238119ae05619a1647e51584a42c 8.0/en/os/i386/httpd-2.0.40-11.i386.rpm
61c76135fbe88268244920b130eb03af 8.0/en/os/i386/httpd-devel-2.0.40-11.i386.rpm
d2146865eb81e380d848d458b254e661 8.0/en/os/i386/httpd-manual-2.0.40-11.i386.rpm
8f2aab8716f5d28f7e49f145bd78cc12 8.0/en/os/i386/mod_ssl-2.0.40-11.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at http://www.redhat.com/about/contact/pgpkey.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://www.apacheweek.com/issues/02-10-04
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0840
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0843
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1157
9. Contact:
The Red Hat security contact is <security@redhat.com>. More contact
details at http://www.redhat.com/solutions/security/news/contact.html
Copyright(c) 2000, 2001, 2002 Red Hat, Inc.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author\'s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBPfmzeih9+71yA2DNAQGoWAQAjfB0eRij61Ldan59/hajiDQrMrzjl488
txR6raRdLILJHHfPJpNrfZnmM4ThPVdoO2Zhedd7rlkZOVNJ97q5+Gptc3SgeUSH
gQi+WUGyS1eWz3ZtB31+qVMNKcp9Co2F9ebuiBiF5yqELG4Y5MoPFNbH8zXXQM34
P6mWHTeG/H0=
=oRNG
-----END PGP SIGNATURE-----