Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1224
Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
7 April 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux Server 7
Windows
Impact/Access: Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote/Unauthenticated
Provide Misleading Information -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-10098 CVE-2019-10097 CVE-2019-10092
CVE-2019-10082 CVE-2019-10081 CVE-2019-1563
CVE-2019-1549 CVE-2019-1547
Reference: ASB-2020.0031
ASB-2020.0020
ESB-2020.1008
ESB-2020.0323
ESB-2019.3408
ESB-2019.3243.3
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:1336
https://access.redhat.com/errata/RHSA-2020:1337
Comment: This bulletin contains two (2) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
Advisory ID: RHSA-2020:1336-01
Product: Red Hat JBoss Core Services
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1336
Issue date: 2020-04-06
CVE Names: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563
CVE-2019-10081 CVE-2019-10082 CVE-2019-10092
CVE-2019-10097 CVE-2019-10098
=====================================================================
1. Summary:
Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 2 zip
release for RHEL 6, RHEL 7 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Description:
Red Hat JBoss Core Services is a set of supplementary software for Red Hat
JBoss middleware products. This software, such as Apache HTTP Server, is
common to multiple JBoss middleware products, and is packaged under Red Hat
JBoss Core Services to allow for faster distribution of updates, and for a
more consistent update experience.
This release adds the new Apache HTTP Server 2.4.37 Service Pack 2 packages
that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack
Apache Server 2.4.37 Service Pack 1 and includes bug fixes and
enhancements. Refer to the Release Notes for information on the most
significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)
* httpd: memory corruption on early pushes (CVE-2019-10081)
* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)
* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)
* openssl: information disclosure in fork() (CVE-2019-1549)
* openssl: information disclosure in PKCS7_dataDecode and
CMS_decrypt_set1_pkey (CVE-2019-1563)
* httpd: limited cross-site scripting in mod_proxy error page
(CVE-2019-10092)
* httpd: mod_rewrite potential open redirect (CVE-2019-10098)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
The References section of this erratum contains a download link (you must
log in to download the update).
Before applying the update, back up your existing Red Hat JBoss Core
Services installation (including all applications and configuration files).
4. Bugs fixed (https://bugzilla.redhat.com/):
1743956 - CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page
1743959 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
1743966 - CVE-2019-10081 httpd: memory corruption on early pushes
1743974 - CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
1743996 - CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
1752090 - CVE-2019-1547 openssl: side-channel weak encryption vulnerability
1752095 - CVE-2019-1549 openssl: information disclosure in fork()
1752100 - CVE-2019-1563 openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey
5. References:
https://access.redhat.com/security/cve/CVE-2019-1547
https://access.redhat.com/security/cve/CVE-2019-1549
https://access.redhat.com/security/cve/CVE-2019-1563
https://access.redhat.com/security/cve/CVE-2019-10081
https://access.redhat.com/security/cve/CVE-2019-10082
https://access.redhat.com/security/cve/CVE-2019-10092
https://access.redhat.com/security/cve/CVE-2019-10097
https://access.redhat.com/security/cve/CVE-2019-10098
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp&downloadType=securityPatches&version=2.4.37
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.openssl&downloadType=securityPatches&version=1.1.1c
https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXot+y9zjgjWX9erEAQg0TxAAmz55mqR/H1CrJ+yAscrw2aUjh0HQMGbe
AcmnemaluF2q5LVRQXiCSH804IRw378H8srbNWMHlHCJXqJ8voqehu+p0AL+inxj
aEJbds87mZhw495cDofuvMm8BmUNGg9kNHQ5jjLS73EoLwiD7kqVLq4H1SF+GRGG
bMBmHCcU74vmbqMIo34yftx1v6oGf6GrSuY03T4lWObdsCOyF9pBciyjZye0Qx38
2RsbA2ILqxREF6RYVVgNsc6kb1tE52C+XepoaORG1tNnYLv5ditcZ7K3/C1aNM5A
CO+bl5qMYMFrBSMsM9sk0jyrGMkvwUTKiOJRRa422NSnrdGOimtZz9shnEMhHf7i
LtNESbzu2fm6uMsgtOpBdlCCfCSxMPutspOu5cp+/gVsuhgrmIoGTTcXJpqR7QsI
/E4YwD9JOhLZrs8Zcj5t+I6Z6XzAKOT366BW9ChnhrLPJkoI4U9CPPWCGmfVLDNA
NhsX8km+8iVBAn8gMsl87QVyiezFtcaxAOvEOeMMflM4XdjSuYOzNXvgZiDb/Gss
QGhU5mXOftNcH3Q9L2u4RW+JNJKM1rXD1qU9mQVU87Evxqm5vVEwfcv/gZVOr51A
gV4flUKpXSRciL/wBS4SnuAzYL1kNxhHOH2skybg+6VJseazkpapdEP+K81Gy+UH
dnPoWHciEk4=
=G9gQ
- -----END PGP SIGNATURE-----
- --------------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 security update
Advisory ID: RHSA-2020:1337-01
Product: Red Hat JBoss Core Services
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1337
Issue date: 2020-04-06
CVE Names: CVE-2019-1547 CVE-2019-1549 CVE-2019-1563
CVE-2019-10081 CVE-2019-10082 CVE-2019-10092
CVE-2019-10097 CVE-2019-10098
=====================================================================
1. Summary:
Updated packages that provide Red Hat JBoss Core Services Pack Apache
Server 2.4.37 and fix several bugs, and add various enhancements are now
available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Core Services on RHEL 6 Server - i386, noarch, ppc64, x86_64
Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64
3. Description:
This release adds the new Apache HTTP Server 2.4.37 Service Pack 2 packages
that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack
Apache Server 2.4.37 Service Pack 1 and includes bug fixes and
enhancements. Refer to the Release Notes for information on the most
significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: side-channel weak encryption vulnerability (CVE-2019-1547)
* httpd: memory corruption on early pushes (CVE-2019-10081)
* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)
* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)
* openssl: information disclosure in fork() (CVE-2019-1549)
* openssl: information disclosure in PKCS7_dataDecode and
CMS_decrypt_set1_pkey (CVE-2019-1563)
* httpd: limited cross-site scripting in mod_proxy error page
(CVE-2019-10092)
* httpd: mod_rewrite potential open redirect (CVE-2019-10098)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1743956 - CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page
1743959 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
1743966 - CVE-2019-10081 httpd: memory corruption on early pushes
1743974 - CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
1743996 - CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip
1752090 - CVE-2019-1547 openssl: side-channel weak encryption vulnerability
1752095 - CVE-2019-1549 openssl: information disclosure in fork()
1752100 - CVE-2019-1563 openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey
6. Package List:
Red Hat JBoss Core Services on RHEL 6 Server:
Source:
jbcs-httpd24-apr-1.6.3-86.jbcs.el6.src.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.src.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el6.src.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el6.src.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.src.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el6.src.rpm
i386:
jbcs-httpd24-apr-1.6.3-86.jbcs.el6.i686.rpm
jbcs-httpd24-apr-debuginfo-1.6.3-86.jbcs.el6.i686.rpm
jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el6.i686.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.i686.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el6.i686.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-debuginfo-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-devel-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-selinux-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-httpd-tools-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el6.i686.rpm
jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-41.Final_redhat_2.jbcs.el6.i686.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.i686.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el6.i686.rpm
jbcs-httpd24-mod_ldap-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_proxy_html-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_session-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-mod_ssl-2.4.37-52.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-debuginfo-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-devel-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-libs-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-perl-1.1.1c-16.jbcs.el6.i686.rpm
jbcs-httpd24-openssl-static-1.1.1c-16.jbcs.el6.i686.rpm
noarch:
jbcs-httpd24-httpd-manual-2.4.37-52.jbcs.el6.noarch.rpm
ppc64:
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.ppc64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el6.ppc64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.ppc64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el6.ppc64.rpm
x86_64:
jbcs-httpd24-apr-1.6.3-86.jbcs.el6.x86_64.rpm
jbcs-httpd24-apr-debuginfo-1.6.3-86.jbcs.el6.x86_64.rpm
jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el6.x86_64.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el6.x86_64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el6.x86_64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-devel-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-selinux-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-httpd-tools-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-41.Final_redhat_2.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_ldap-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_proxy_html-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_session-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-mod_ssl-2.4.37-52.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-debuginfo-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-devel-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-libs-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-perl-1.1.1c-16.jbcs.el6.x86_64.rpm
jbcs-httpd24-openssl-static-1.1.1c-16.jbcs.el6.x86_64.rpm
Red Hat JBoss Core Services on RHEL 7 Server:
Source:
jbcs-httpd24-apr-1.6.3-86.jbcs.el7.src.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el7.src.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el7.src.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el7.src.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el7.src.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el7.src.rpm
noarch:
jbcs-httpd24-httpd-manual-2.4.37-52.jbcs.el7.noarch.rpm
ppc64:
jbcs-httpd24-brotli-1.0.6-21.jbcs.el7.ppc64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el7.ppc64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el7.ppc64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el7.ppc64.rpm
x86_64:
jbcs-httpd24-apr-1.6.3-86.jbcs.el7.x86_64.rpm
jbcs-httpd24-apr-debuginfo-1.6.3-86.jbcs.el7.x86_64.rpm
jbcs-httpd24-apr-devel-1.6.3-86.jbcs.el7.x86_64.rpm
jbcs-httpd24-brotli-1.0.6-21.jbcs.el7.x86_64.rpm
jbcs-httpd24-brotli-debuginfo-1.0.6-21.jbcs.el7.x86_64.rpm
jbcs-httpd24-brotli-devel-1.0.6-21.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-debuginfo-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-devel-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-selinux-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-httpd-tools-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_cluster-native-1.3.12-41.Final_redhat_2.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-41.Final_redhat_2.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_http2-1.11.3-22.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_http2-debuginfo-1.11.3-22.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_ldap-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_proxy_html-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_session-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-mod_ssl-2.4.37-52.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-debuginfo-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-devel-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-libs-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-perl-1.1.1c-16.jbcs.el7.x86_64.rpm
jbcs-httpd24-openssl-static-1.1.1c-16.jbcs.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-1547
https://access.redhat.com/security/cve/CVE-2019-1549
https://access.redhat.com/security/cve/CVE-2019-1563
https://access.redhat.com/security/cve/CVE-2019-10081
https://access.redhat.com/security/cve/CVE-2019-10082
https://access.redhat.com/security/cve/CVE-2019-10092
https://access.redhat.com/security/cve/CVE-2019-10097
https://access.redhat.com/security/cve/CVE-2019-10098
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.37/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXouCx9zjgjWX9erEAQg57RAAni5W7SYIMdXwBveY7LVVU8HUzHhrOSH0
H6dPGPAhcfR2XehGfODuqax7Ma94mZKE2PXxujpmxlA1Scg+IvpG9Mrj4QllKgEU
v+Gsq8Hs3LtZS7B1sytl2vIKUOuUhjR8W+61Zh5X8oG5POhQbaavjTakGjPHt8AU
mXWraZevjvIzHWKitg9dhAbCerEy+aaf4yhgrXadqv5kwT1ud2TNqDqR4ayAx4Gm
UjOTvhg04eMExzTIUjabpN1khA70tMljxWWTwwejj2uCXeGEggImkL4hM882FwVZ
Z9FTyQjY92r8S8jbxmQxo7MC7bSoZGrl//Dg+4EA+60j1p7OjXISLKXBZYoQcrtr
c+CZXbUVPXH8vBcGF5TixrfbpZnF2GYq4S0XajhhXWJ0kskAR4zAjTmD5w8vVIBr
PJ/yPeAYSFjkDuKaKnbvrXN8YS4hLfcW5EbwsSD5GXF1bgC9pftdpJJ321ElSYIW
zdqujswl6NbMozTXBPbxF3lmNY+DpDeJZ9FZy5nfDxpGNNzkk9kdkrQlUZ5Uy/78
1/kEmhhAnr0s19WPsbhAk4mdzFr+pcRYZcJTtsOVTH3CoVO2+g9icZOLmmkk3lx3
L4GcquyY7qYsn2frT5HuGME/iXpkKjlJlY0EjUEjvPCO9IzLWlGMWDvKXNG/Ma7L
i1VWpzjNjpU=
=uXCZ
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXovREmaOgq3Tt24GAQjRag//Z+KX6UD512IFYCW3AgmmDl+iZ8gLdR9L
oWZb0CC1lOGdGgqjygRlQJ/OmmtYqR0CTKH1pkbzfx5WJjgjDKmz2ZBdaZVNyXA7
4h06AxS1pSUNsVgNTZMswb4dj31B1W2wpeMebPfAJQCXZ6nQ1KTPHgvLw5MVe780
1YnsUvylxFwrxVWSgTJ7qBFEKFVPgxJEjiea7PHfmSQPIpLpHp7IemNphUuaXhQF
pqeatEDWy432zbf61L2jijkemTQ8Uc3jn4bBE/gS/K88aH7HgMdlW6STB1vyYZn4
eGUFXvcWwreucawONaFMpcpGa2rWCSsW0J88KBgkMRLe3WvWP0NSe7EbeeAx2wFv
/FzXVus5Jk7Kd9UwYxk3zJMYUXVjFDyPiD/bBLKSojp8m22ZNp1YxWW3ughBwLp0
PTAlm5XhamA1OVwgOGFdb0B1UatmO3DigSbclZZaXrQjfqxExIQLZ18StTqvkg1F
lvdRanS5cS1sKBjRbV9vV0iugoUdy7ZaL5bEXkkpXsKzZFqqI57NcQT4jiwYyjil
gugVIgn3WcCzOLvpzuAOeuLxV12d81aQlw3B5BCKRUzpCTfKRKQjSPobjf4HXR3M
E+Qp2WbC95ovIRwPJZISXtgTXlqV/Iw9ub6zmVfdE5xaO0d6LwoJZ2AHeZM0fcEE
DkFvFRFChPU=
=KUnf
-----END PGP SIGNATURE-----