drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Pufferüberlauf in mod_ssl
Name: |
Pufferüberlauf in mod_ssl
|
|
ID: |
SSA:2004-207-02 |
|
Distribution: |
Slackware |
|
Plattformen: |
Slackware -current, Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0 |
|
Datum: |
Mo, 26. Juli 2004, 13:00 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
mod_ssl |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
[slackware-security] new mod_ssl packages (SSA:2004-207-02)
New mod_ssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0 and -current to fix a security issue. A format string vulnerability in mod_proxy hook functions could allow an attacker to run code as the mod_ssl user. Sites using mod_ssl should upgrade (be sure to back up your existing key files first).
Here are the details from the Slackware 10.0 ChangeLog: +--------------------------+ Sun Jul 25 14:17:29 PDT 2004 patches/packages/mod_ssl-2.8.19_1.3.31-i486-1.tgz: Upgraded to mod_ssl-2.8.19-1.3.31. This fixes a security hole (ssl_log() related format string vulnerability in mod_proxy hook functions), so sites using mod_ssl should upgrade to the new version. Be sure to back up your existing key files first. (* Security fix *) +--------------------------+
Where to find the new packages: +-----------------------------+
Updated package for Slackware 8.1: mod_ssl-2.8.19_1.3.31-i386-1.tgz
Updated package for Slackware 9.0: mod_ssl-2.8.19_1.3.31-i386-1.tgz
Updated package for Slackware 9.1: mod_ssl-2.8.19_1.3.31-i486-1.tgz
Updated package for Slackware 10.0: mod_ssl-2.8.19_1.3.31-i486-1.tgz
Updated package for Slackware -current: mod_ssl-2.8.19_1.3.31-i486-1.tgz
MD5 signatures: +-------------+
Slackware 8.1 package: 363f86afca6946e4840d7e2ed5efcc96 mod_ssl-2.8.19_1.3.31-i386-1.tgz
Slackware 9.0 package: d213da77d2f8822206b76cf9c6c81067 mod_ssl-2.8.19_1.3.31-i386-1.tgz
Slackware 9.1 package: d304dc1cf684e60c3611c998ac055986 mod_ssl-2.8.19_1.3.31-i486-1.tgz
Slackware 10.0 package: efb6b8193b4c6189c9ae5fe2035526da mod_ssl-2.8.19_1.3.31-i486-1.tgz
Slackware -current package: efb6b8193b4c6189c9ae5fe2035526da mod_ssl-2.8.19_1.3.31-i486-1.tgz
Installation instructions: +------------------------+
First, stop apache:
# apachectl stop
IMPORTANT: Backup any keys/certificates you wish to save for mod_ssl (in /etc/apache/ssl.*)
Next, upgrade these packages as root:
# upgradepkg mod_ssl-2.8.19_1.3.31-i486-1.tgz
If necessary, restore any mod_ssl config files.
Finally, restart apache:
# apachectl startssl
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBBHR5akRjwEAQIjMRApBdAKCJ7WNiDvxuixkHZF9AWaJu3fpuLwCfcylt xRfkR9Vlu0ATie7ynR6kA5w= =eBKw -----END PGP SIGNATURE-----
|
|
|
|