Login
Newsletter
Werbung

Sicherheit: Mehrere Lücken in Apache beseitigt
Aktuelle Meldungen Distributionen
Name: Mehrere Lücken in Apache beseitigt
ID:
Distribution: Slackware
Plattformen: Keine Angabe
Datum: Di, 17. Oktober 2000, 13:00
Referenzen: Keine Angabe
Applikationen: Apache

Originalnachricht

Several security problems have been found in the Apache web server
software. It is recommended that all users of Apache upgrade to the
latest stable release to fix these problems.

Apache is included in our N software series in the apache.tgz package. A
new apache.tgz package including Apache 1.3.14 is available in the
Slackware -current tree. All users of Slackware 7.0, 7.1, and -current
are urged to upgraded to this package.


=========================================
apache 1.3.14 AVAILABLE - (n1/apache.tgz)
=========================================

The following security problems have been fixed with the release of
Apache 1.3.14:

* A problem with the Rewrite module, mod_rewrite, allowed access to
any file on the web server under certain circumstances.

* The handling of Host: headers in mass virtual hosting configurations,
mod_vhost_alias, could allow access to any file on the server.

* If a cgi-bin directory is under the document root, the source to
the scripts inside it could be sent if using mass virtual hosting.

The new Slackware apache.tgz package can be downloaded from the
-current branch:

apache.tgz

This package is *ONLY* for users of Slackware 7.0 and higher. All
users of Slackware 7.0 and higher that use Apache are urged to upgrade
to this new package.

For verification purposes, we provide the following checksums:

16-bit "sum" checksum:
36187 2184 n1/apache.tgz

128-bit MD5 message digest:
42cabff64514457bf9e81e55decda9fe n1/apache.tgz

Installation instructions for the apache.tgz package:

Make sure Apache is not running:

# /var/lib/apache/sbin/apachectl stop

Upgrade the package:

# upgradepkg apache.tgz

Restart Apache:

# /etc/rc.d/rc.httpd


You should definitely backup your Apache configuration files and data, as
upgrading this package will overwrite them with the defaults in the
package.

- Slackware Linux Security Team
http://www.slackware.com

+------------------------------------------------------------------------+
| HOW TO REMOVE YOURSELF FROM THIS MAILING LIST: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back. Follow the instructions to |
| complete the unsubscription. Do not reply to this message to |
| unsubscribe! |
+------------------------------------------------------------------------+
Pro-Linux
Pro-Linux @Twitter
Neue Nachrichten
Werbung