Login
Newsletter
Werbung

Sicherheit: Denial of Service in apache-mod_security
Aktuelle Meldungen Distributionen
Name: Denial of Service in apache-mod_security
ID: MDVSA-2013:187
Distribution: Mandriva
Plattformen: Mandriva Enterprise Server 5.0, Mandriva Business Server 1.0
Datum: Di, 2. Juli 2013, 15:04
Referenzen: http://advisories.mageia.org/MGASA-2013-0179.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2765
Applikationen: apache-mod_security

Originalnachricht

This is a multi-part message in MIME format...

------------=_1372763027-2483-23

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:187
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : apache-mod_security
Date : July 2, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Updated apache-mod_security packages fix security vulnerability:

When ModSecurity receives a request body with a size bigger than the
value set by the SecRequestBodyInMemoryLimit and with a Content-Type
that has no request body processor mapped to it, ModSecurity will
systematically crash on every call to forceRequestBodyVariable (in
phase 1) (CVE-2013-2765).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2765
http://advisories.mageia.org/MGASA-2013-0179.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
d96691d5037b826c0ef3977a1e2bb22b
mes5/i586/apache-mod_security-2.5.12-0.5mdvmes5.2.i586.rpm
3c61a5602aa5bf2727fb1a4114f5be91 mes5/i586/mlogc-2.5.12-0.5mdvmes5.2.i586.rpm

955ef3d68ba21db4909a61623eb9a24c
mes5/SRPMS/apache-mod_security-2.5.12-0.5mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
eb0232716c8057ed7d03f461d4f4233d
mes5/x86_64/apache-mod_security-2.5.12-0.5mdvmes5.2.x86_64.rpm
f138a1c5b019df8b80b48fc084c44432
mes5/x86_64/mlogc-2.5.12-0.5mdvmes5.2.x86_64.rpm
955ef3d68ba21db4909a61623eb9a24c
mes5/SRPMS/apache-mod_security-2.5.12-0.5mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
6c22d83dc3a60409f00ab408646d2de3
mbs1/x86_64/apache-mod_security-2.6.3-5.3.mbs1.x86_64.rpm
eef3d933ed0d9bfbe05faca382446f7d mbs1/x86_64/mlogc-2.6.3-5.3.mbs1.x86_64.rpm
61f6889bf73f70137571c8ceb29c9516
mbs1/SRPMS/apache-mod_security-2.6.3-5.3.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFR0obfmqjQ0CJFipgRAgxoAJ0b36mh6rUuaxM4kOWWSY5rIWU8zACfT5Y5
KB1jMfsMIw5K4b7ZKax32BY=
=23/c
-----END PGP SIGNATURE-----


------------=_1372763027-2483-23
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1372763027-2483-23--
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung