-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                Mandrake Linux Security Update Advisory
 _______________________________________________________________________

 Package name:           apache
 Advisory ID:            MDKSA-2003:103
 Date:                   November 3rd, 2003

 Affected versions:	 9.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 A buffer overflow in mod_alias and mod_rewrite was discovered in Apache
 versions 1.3.19 and earlier as well as Apache 2.0.47 and earlier.  This
 happens when a regular expression with more than 9 captures is
 confined.  An attacker would have to create a carefully crafted
 configuration file (.htaccess or httpd.conf) in order to exploit these
 problems.
 
 As well, another buffer overflow in Apache 2.0.47 and earlier in
 mod_cgid's mishandling of CGI redirect paths could result in CGI output
 going to the wrong client when a threaded MPM is used.
 
 Apache version 2.0.48 and 1.3.29 were released upstream to correct
 these bugs; backported patches have been applied to the provided
 packages.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0789
  http://www.apache.org/dist/httpd/Announcement.html
  http://www.apache.org/dist/httpd/Announcement2.html
 ______________________________________________________________________

 Updated Packages:
  
 Corporate Server 2.1:
 02895e0914bc1a0885000cef805f7759 
 corporate/2.1/RPMS/apache-1.3.26-6.3.90mdk.i586.rpm
 ee997dd297049bc75878a5de8904c965 
 corporate/2.1/RPMS/apache-common-1.3.26-6.3.90mdk.i586.rpm
 63806c79f65ee1a1830caa41b0cf3784 
 corporate/2.1/RPMS/apache-devel-1.3.26-6.3.90mdk.i586.rpm
 68f2aca22d84d56b234aaaa2e348d2aa 
 corporate/2.1/RPMS/apache-manual-1.3.26-6.3.90mdk.i586.rpm
 ed0d46c1a861a09dbe36b5ccdb02754d 
 corporate/2.1/RPMS/apache-modules-1.3.26-6.3.90mdk.i586.rpm
 8788c3001078f32e975941aa7a556cd1 
 corporate/2.1/RPMS/apache-source-1.3.26-6.3.90mdk.i586.rpm
 ed87d94ec5aeb007d98717e7d1a3d314 
 corporate/2.1/SRPMS/apache-1.3.26-6.3.90mdk.src.rpm

 Corporate Server 2.1/x86_64:
 91700397109a221089871e610ee438f3 
 x86_64/corporate/2.1/RPMS/apache-1.3.26-6.3.90mdk.x86_64.rpm
 8e63504cfe91f209653401569c059042 
 x86_64/corporate/2.1/RPMS/apache-common-1.3.26-6.3.90mdk.x86_64.rpm
 c71ee8d0d00d504beaa1bd3259152d28 
 x86_64/corporate/2.1/RPMS/apache-devel-1.3.26-6.3.90mdk.x86_64.rpm
 931135aefb6bc1214ba40621d9172ac1 
 x86_64/corporate/2.1/RPMS/apache-manual-1.3.26-6.3.90mdk.x86_64.rpm
 d46a618a36786f7eec1d5f494e794bda 
 x86_64/corporate/2.1/RPMS/apache-modules-1.3.26-6.3.90mdk.x86_64.rpm
 3b08e1dcfc7ef233dbd3ce9c6fff41d1 
 x86_64/corporate/2.1/RPMS/apache-source-1.3.26-6.3.90mdk.x86_64.rpm
 ed87d94ec5aeb007d98717e7d1a3d314 
 x86_64/corporate/2.1/SRPMS/apache-1.3.26-6.3.90mdk.src.rpm

 Mandrake Linux 9.0:
 02895e0914bc1a0885000cef805f7759  9.0/RPMS/apache-1.3.26-6.3.90mdk.i586.rpm
 ee997dd297049bc75878a5de8904c965 
 9.0/RPMS/apache-common-1.3.26-6.3.90mdk.i586.rpm
 63806c79f65ee1a1830caa41b0cf3784 
 9.0/RPMS/apache-devel-1.3.26-6.3.90mdk.i586.rpm
 68f2aca22d84d56b234aaaa2e348d2aa 
 9.0/RPMS/apache-manual-1.3.26-6.3.90mdk.i586.rpm
 ed0d46c1a861a09dbe36b5ccdb02754d 
 9.0/RPMS/apache-modules-1.3.26-6.3.90mdk.i586.rpm
 8788c3001078f32e975941aa7a556cd1 
 9.0/RPMS/apache-source-1.3.26-6.3.90mdk.i586.rpm
 ed87d94ec5aeb007d98717e7d1a3d314  9.0/SRPMS/apache-1.3.26-6.3.90mdk.src.rpm

 Mandrake Linux 9.1:
 3a24d35dcd08d4c82ccd6fac204047bc  9.1/RPMS/apache-1.3.27-8.1.91mdk.i586.rpm
 61cde3633d0866c6f03e29565ea56360 
 9.1/RPMS/apache-devel-1.3.27-8.1.91mdk.i586.rpm
 e58a9378cff2e24bcbfe6c56d08f2505 
 9.1/RPMS/apache-modules-1.3.27-8.1.91mdk.i586.rpm
 4b47d0bc773d59a17d5a40f627569707 
 9.1/RPMS/apache-source-1.3.27-8.1.91mdk.i586.rpm
 c780a92fd6dbb3cdd0d52049c534778f  9.1/RPMS/apache2-2.0.47-1.6.91mdk.i586.rpm
 41e7366c6dfa0331ed48027e3a2dd881 
 9.1/RPMS/apache2-common-2.0.47-1.6.91mdk.i586.rpm
 230d990186ca121121bbc4e1720afb3d 
 9.1/RPMS/apache2-devel-2.0.47-1.6.91mdk.i586.rpm
 36894b37c5eb5dfa628f6a2fe3de5580 
 9.1/RPMS/apache2-manual-2.0.47-1.6.91mdk.i586.rpm
 76e8293d061a84d9413453e1d6c282b6 
 9.1/RPMS/apache2-mod_dav-2.0.47-1.6.91mdk.i586.rpm
 bb106f0ebd893e4547ef3f0a6d1572f9 
 9.1/RPMS/apache2-mod_ldap-2.0.47-1.6.91mdk.i586.rpm
 17003f2c15c2379275caf21fe097c7a9 
 9.1/RPMS/apache2-mod_ssl-2.0.47-1.6.91mdk.i586.rpm
 d595f9e2c94b646869087a15e8138a44 
 9.1/RPMS/apache2-modules-2.0.47-1.6.91mdk.i586.rpm
 b119835d0d18b01613e7977f4daa7a38 
 9.1/RPMS/apache2-source-2.0.47-1.6.91mdk.i586.rpm
 7c3b7fc1bed6ed59b8a328d8ac3b3056  9.1/RPMS/libapr0-2.0.47-1.6.91mdk.i586.rpm
 a187d7819937e82deea23da621f38ee5  9.1/SRPMS/apache-1.3.27-8.1.91mdk.src.rpm
 31a46639efb035b67ea3b70f91815d9b  9.1/SRPMS/apache2-2.0.47-1.6.91mdk.src.rpm

 Mandrake Linux 9.1/PPC:
 6cf015976106eaaa8bdbfb46501c5339  ppc/9.1/RPMS/apache-1.3.27-8.1.91mdk.ppc.rpm
 41f85b24716c140bdd5f041200d6f68c 
 ppc/9.1/RPMS/apache-devel-1.3.27-8.1.91mdk.ppc.rpm
 12ea7768f27c739f433f8cd856e8f3ed 
 ppc/9.1/RPMS/apache-modules-1.3.27-8.1.91mdk.ppc.rpm
 8ddfdeb72fe3058ae83076ad00b184c4 
 ppc/9.1/RPMS/apache-source-1.3.27-8.1.91mdk.ppc.rpm
 7ecb812bb84877964bd0244527042b7c 
 ppc/9.1/RPMS/apache2-2.0.47-1.6.91mdk.ppc.rpm
 df9dbdcaf995332bc2950f3b64e0b5cd 
 ppc/9.1/RPMS/apache2-common-2.0.47-1.6.91mdk.ppc.rpm
 7efb7e7271527bef25ac76c017cf940f 
 ppc/9.1/RPMS/apache2-devel-2.0.47-1.6.91mdk.ppc.rpm
 46e0066408b8c9c2f537315b9d7de495 
 ppc/9.1/RPMS/apache2-manual-2.0.47-1.6.91mdk.ppc.rpm
 832793eba23c7f55544ade7478d66971 
 ppc/9.1/RPMS/apache2-mod_dav-2.0.47-1.6.91mdk.ppc.rpm
 1338474c76c753216f024f6df189a369 
 ppc/9.1/RPMS/apache2-mod_ldap-2.0.47-1.6.91mdk.ppc.rpm
 2f1fc4f54067d4ed4e13a24de93ac2b2 
 ppc/9.1/RPMS/apache2-mod_ssl-2.0.47-1.6.91mdk.ppc.rpm
 c9e89384dced046092fb96e3f4c71cd3 
 ppc/9.1/RPMS/apache2-modules-2.0.47-1.6.91mdk.ppc.rpm
 893a388ffd122c25b021ccaedcaf3bc8 
 ppc/9.1/RPMS/apache2-source-2.0.47-1.6.91mdk.ppc.rpm
 8797a894c157099d8fa59e0ee6a09725 
 ppc/9.1/RPMS/libapr0-2.0.47-1.6.91mdk.ppc.rpm
 a187d7819937e82deea23da621f38ee5 
 ppc/9.1/SRPMS/apache-1.3.27-8.1.91mdk.src.rpm
 31a46639efb035b67ea3b70f91815d9b 
 ppc/9.1/SRPMS/apache2-2.0.47-1.6.91mdk.src.rpm

 Mandrake Linux 9.2:
 87b439a1ea3c7a53ae6bd65b8de8823d  9.2/RPMS/apache-1.3.28-3.1.92mdk.i586.rpm
 a7dd2cfc0f24e74285756df47b8b2560 
 9.2/RPMS/apache-devel-1.3.28-3.1.92mdk.i586.rpm
 e9396a1d140c37ed3c54c9fc8946b075 
 9.2/RPMS/apache-modules-1.3.28-3.1.92mdk.i586.rpm
 59f841c1809a057b7db9809f98902e2a 
 9.2/RPMS/apache-source-1.3.28-3.1.92mdk.i586.rpm
 67ea76c94fd96d4b58902f347e7424a4  9.2/RPMS/apache2-2.0.47-6.3.92mdk.i586.rpm
 57972c71c8489d0a3c9a68185031b879 
 9.2/RPMS/apache2-common-2.0.47-6.3.92mdk.i586.rpm
 3f3fb3d57b63cc56df9d6c7318a7cac5 
 9.2/RPMS/apache2-devel-2.0.47-6.3.92mdk.i586.rpm
 cea519816faccd534f542965fbbf9d15 
 9.2/RPMS/apache2-manual-2.0.47-6.3.92mdk.i586.rpm
 8d591555255d4348900fcd1bbc74061e 
 9.2/RPMS/apache2-mod_cache-2.0.47-6.3.92mdk.i586.rpm
 0e1fbe572782f546b44054a0265ea06e 
 9.2/RPMS/apache2-mod_dav-2.0.47-6.3.92mdk.i586.rpm
 3421ea0f95a7d897d9d339bf6e3aae33 
 9.2/RPMS/apache2-mod_deflate-2.0.47-6.3.92mdk.i586.rpm
 46bec7aa9274f16aa9768aa6ffec0cb5 
 9.2/RPMS/apache2-mod_disk_cache-2.0.47-6.3.92mdk.i586.rpm
 d343b2d6a22f52a2ff5dd2844005c0f2 
 9.2/RPMS/apache2-mod_file_cache-2.0.47-6.3.92mdk.i586.rpm
 8f6b81b7933f766fc979254f4ce3b83c 
 9.2/RPMS/apache2-mod_ldap-2.0.47-6.3.92mdk.i586.rpm
 fedeaeb50040b8292f5b4da2cb27fc4e 
 9.2/RPMS/apache2-mod_mem_cache-2.0.47-6.3.92mdk.i586.rpm
 63774164ba26208b71a2a7a5f5136550 
 9.2/RPMS/apache2-mod_proxy-2.0.47-6.3.92mdk.i586.rpm
 0399f23f2c87e07d18bb98617c79f24c 
 9.2/RPMS/apache2-mod_ssl-2.0.47-6.3.92mdk.i586.rpm
 36e47d1f2ba0a23d6c1055fe6f606134 
 9.2/RPMS/apache2-modules-2.0.47-6.3.92mdk.i586.rpm
 1af39eba2fff3635a323dfec02a333fb 
 9.2/RPMS/apache2-source-2.0.47-6.3.92mdk.i586.rpm
 4b7d2788a521162aa67237db2dbc0c3d  9.2/RPMS/libapr0-2.0.47-6.3.92mdk.i586.rpm
 e6603582c732931d8c8186547eee702d  9.2/SRPMS/apache-1.3.28-3.1.92mdk.src.rpm
 6407cf397b65ebf7b66554d7a1445489  9.2/SRPMS/apache2-2.0.47-6.3.92mdk.src.rpm

 Multi Network Firewall 8.2:
 4ae3471596b2301da8062c38e7406c38 
 mnf8.2/RPMS/apache-1.3.23-4.3.M82mdk.i586.rpm
 fd001d68be7fc7086ca7493da05db4f0 
 mnf8.2/RPMS/apache-common-1.3.23-4.3.M82mdk.i586.rpm
 b7776aac2533499a79c820d0097187a0 
 mnf8.2/RPMS/apache-modules-1.3.23-4.3.M82mdk.i586.rpm
 98df8da770fe4b3ede43e4af4e9de067 
 mnf8.2/SRPMS/apache-1.3.23-4.3.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 A list of FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

 All packages are signed by MandrakeSoft for security.  You can obtain
 the GPG public key of the Mandrake Linux Security Team by executing:

  gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98

 Please be aware that sometimes it takes the mirrors a few hours to
 update.

 You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

 MandrakeSoft has several security-related mailing list services that
 anyone can subscribe to.  Information on these lists can be obtained by
 visiting:

  http://www.mandrakesecure.net/en/mlist.php

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE/pu8lmqjQ0CJFipgRAkziAJ9NZx+harn15u3ZByaE6RMMKasl5wCeNRcq
iM5sSfISyCmb1GE8szE+aZM=
=qcI3
-----END PGP SIGNATURE-----