Login
Newsletter
Werbung

Sicherheit: Cross-Site Scripting in Apache
Aktuelle Meldungen Distributionen
Name: Cross-Site Scripting in Apache
ID: SSA:2006-129-01
Distribution: Slackware
Plattformen: Slackware -current, Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1, Slackware 10.2
Datum: Mi, 10. Mai 2006, 01:19
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352
Applikationen: Apache

Originalnachricht


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] Apache httpd (SSA:2006-129-01)

New Apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,
10.2, and -current to fix security issues.

More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352

In addition, new mod_ssl packages for Apache 1.3.35 are available for
all of these versions of Slackware, and new versions of PHP are
available for Slackware -current. These additional packages do not
fix security issues, but may be required on your system depending on
your Apache setup.

One more note about this round of updates: the packages have been given
build versions that indicate which version of Slackware they are meant
to patch, such as -1_slack8.1, or -1_slack9.0, etc. This should help to
avoid some of the issues with automatic upgrade tools by providing a
unique package name when the same fix is deployed across multiple
Slackware versions. Only patches applied to -current will have the
simple build number, such as -1.


Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/apache-1.3.35-i486-1_slack10.2.tgz:
Upgraded to apache-1.3.35.
From the official announcement:
Of particular note is that 1.3.35 addresses and fixes 1 potential
security issue: CVE-2005-3352 (cve.mitre.org)
mod_imap: Escape untrusted referer header before outputting in HTML
to avoid potential cross-site scripting. Change also made to
ap_escape_html so we escape quotes. Reported by JPCERT
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352
(* Security fix *)
patches/packages/mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz:
Upgraded to mod_ssl-2.8.26-1.3.35.
This is an updated version designed for Apache 1.3.35.
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated package for Slackware 8.1:
apache-1.3.35-i386-1_slack8.1.tgz
mod_ssl-2.8.26_1.3.35-i386-1_slack8.1.tgz

Updated package for Slackware 9.0:
apache-1.3.35-i386-1_slack9.0.tgz
mod_ssl-2.8.26_1.3.35-i386-1_slack9.0.tgz

Updated package for Slackware 9.1:
apache-1.3.35-i486-1_slack9.1.tgz
mod_ssl-2.8.26_1.3.35-i486-1_slack9.1.tgz

Updated package for Slackware 10.0:
apache-1.3.35-i486-1_slack10.0.tgz
mod_ssl-2.8.26_1.3.35-i486-1_slack10.0.tgz

Updated package for Slackware 10.1:
apache-1.3.35-i486-1_slack10.1.tgz
mod_ssl-2.8.26_1.3.35-i486-1_slack10.1.tgz

Updated package for Slackware 10.2:
apache-1.3.35-i486-1_slack10.2.tgz
mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz

Updated package for Slackware -current:
apache-1.3.35-i486-1.tgz
mod_ssl-2.8.26_1.3.35-i486-1.tgz
php-4.4.2-i486-4.tgz


MD5 signatures:
+-------------+

Slackware 8.1 packages:
208bbe94a46f8d05e15f1ccdb38f9a91 apache-1.3.35-i386-1_slack8.1.tgz
9172a6d347df033d024a7ba786c47bfe mod_ssl-2.8.26_1.3.35-i386-1_slack8.1.tgz

Slackware 9.0 packages:
0482ca192a7b94c254421c717634e628 apache-1.3.35-i386-1_slack9.0.tgz
913763c2e12d6d2a101ce4a539f060f3 mod_ssl-2.8.26_1.3.35-i386-1_slack9.0.tgz

Slackware 9.1 packages:
d96044932ab33623425c328862a3750f apache-1.3.35-i486-1_slack9.1.tgz
ae58ab559c60a475330514dca689d735 mod_ssl-2.8.26_1.3.35-i486-1_slack9.1.tgz

Slackware 10.0 packages:
2beb7c88f4f28adbe61e13d79889a27e apache-1.3.35-i486-1_slack10.0.tgz
403f1297bcc9cff0df3f9afcb16d69b6 mod_ssl-2.8.26_1.3.35-i486-1_slack10.0.tgz

Slackware 10.1 packages:
4a0b68ddf002a300e536e584c3eb2923 apache-1.3.35-i486-1_slack10.1.tgz
f24d6776f221cc61f2b0b98cd1fc1ae9 mod_ssl-2.8.26_1.3.35-i486-1_slack10.1.tgz

Slackware 10.2 packages:
bbaed7e942e5f1c7380b3def44d54d74 apache-1.3.35-i486-1_slack10.2.tgz
e70a300f5c4333ae1d31e8d852b89dc3 mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz

Slackware -current packages:
b662f564f048ace17eaafc7e50bed7b2 apache-1.3.35-i486-1.tgz
c7d403fc891e210d1f1a71c559939cd5 mod_ssl-2.8.26_1.3.35-i486-1.tgz
fb78ce30aece8d8718ed722be319dd2b php-4.4.2-i486-4.tgz


Installation instructions:
+------------------------+

First, stop apache:

# apachectl stop

Then, upgrade the apache package:

# upgradepkg apache-1.3.35-i486-1_slack10.2.tgz

If you use mod_ssl, you'll also need to upgrade that package. The
upgrade should save the important config files for mod_ssl,
nevertheless it's a good idea to backup any keys/certificates you wish
to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl:

# upgradepkg mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz

If necessary, restore any mod_ssl config files.

If you are using PHP on Slackware -current, upgrade the PHP package.

Finally, restart apache:

# apachectl start

Or, if you use mod_ssl:

# apachectl startssl


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFEYQqqakRjwEAQIjMRApaqAJ9sPY3cIrYMIw3nDeMMUbys2uJwIQCfS6dN
1FRu06PhavAi7XyCLfpA4kw=
=3hdX
-----END PGP SIGNATURE-----
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung