Login
Newsletter
Werbung

Sicherheit: Pufferüberlauf in mod_ssl
Aktuelle Meldungen Distributionen
Name: Pufferüberlauf in mod_ssl
ID: CSSA-2002-031.0
Distribution: Caldera
Plattformen: Caldera Server 3.1, Caldera Workstation 3.1, Caldera Server 3.1.1, Caldera Workstation 3.1.1
Datum: Mi, 17. Juli 2002, 13:00
Referenzen: Keine Angabe
Applikationen: mod_ssl

Originalnachricht

--OgqxwSJOaUobr8KG
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com
security-alerts@linuxsecurity.com

______________________________________________________________________________

Caldera International, Inc. Security Advisory

Subject: Linux: mod_ssl off-by-one error
Advisory number: CSSA-2002-031.0
Issue date: 2002 July 16
Cross reference:
______________________________________________________________________________


1. Problem Description

mod_ssl registers a rewrite_command hook when backward
compatibility is enabled. The ssl_compat_directive() is called
for every line read in a configuration file, and contains an
off-by-one error while doing so.


2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------

OpenLinux 3.1.1 Server prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

OpenLinux 3.1.1 Workstation prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

OpenLinux 3.1 Server prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

OpenLinux 3.1 Workstation prior to mod_ssl-2.8.5_1.3.22-3.i386.rpm
prior to mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm


3. Solution

The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

4.2 Packages

c998c03318358630584215190a470c9c mod_ssl-2.8.5_1.3.22-3.i386.rpm
1586b281a0888d306cb5efe35ff86954 mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

4.3 Installation

rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

4.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

4.5 Source Packages

850ea026cc10315dce3dbaef9feabc8c mod_ssl-2.8.5_1.3.22-3.src.rpm


5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

5.2 Packages

ef912916b08251e9f6b0876a8c052b8f mod_ssl-2.8.5_1.3.22-3.i386.rpm
d57dae4310139ce3ea0e3979e643a9ac mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

5.3 Installation

rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

5.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

5.5 Source Packages

c34cc1e566f049573dc41b1323849101 mod_ssl-2.8.5_1.3.22-3.src.rpm


6. OpenLinux 3.1 Server

6.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

6.2 Packages

3711fdb7fbc8a8f0dd0b5c2408709872 mod_ssl-2.8.5_1.3.22-3.i386.rpm
0522228a7472586099b91a499a9b2b4f mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

6.3 Installation

rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

6.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

6.5 Source Packages

bf52c48ab7e18daa6cea04928fb85419 mod_ssl-2.8.5_1.3.22-3.src.rpm


7. OpenLinux 3.1 Workstation

7.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

7.2 Packages

0769c955e7be0acee8a78929cbb9d96c mod_ssl-2.8.5_1.3.22-3.i386.rpm
4d6773201e7ebd88fb2153e7eaca13b0 mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

7.3 Installation

rpm -Fvh mod_ssl-2.8.5_1.3.22-3.i386.rpm
rpm -Fvh mod_ssl-sxnet-2.8.5_1.3.22-3.i386.rpm

7.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

7.5 Source Packages

ad1ede2408cf40e319fc647986eca21b mod_ssl-2.8.5_1.3.22-3.src.rpm


8. References

Specific references for this advisory:
http://www.modssl.org/

Caldera security resources:
http://www.caldera.com/support/security/index.html

This security fix closes Caldera incidents sr866328, fz521400,
erg712092.


9. Disclaimer

Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.


10. Acknowledgements

Frank Denis (j@pureftpd.org) discovered and researched this
vulnerability.

______________________________________________________________________________

--OgqxwSJOaUobr8KG
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj00myoACgkQbluZssSXDTEonwCg+RUinrIZxqwbbt3zNL7qrfsM
UewAn0n+Ft0T5qU//SkqEG6fKNvw+1nM
=5//3
-----END PGP SIGNATURE-----

--OgqxwSJOaUobr8KG--
Pro-Linux
Pro-Linux @Twitter
Neue Nachrichten
Werbung