drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Denial of Service in apache-mod_security
Name: |
Denial of Service in apache-mod_security |
|
ID: |
MDVSA-2013:187 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Enterprise Server 5.0, Mandriva Business Server 1.0 |
|
Datum: |
Di, 2. Juli 2013, 15:04 |
|
Referenzen: |
http://advisories.mageia.org/MGASA-2013-0179.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2765 |
|
Applikationen: |
ModSecurity |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1372763027-2483-23
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:187 http://www.mandriva.com/en/support/security/ _______________________________________________________________________
Package : apache-mod_security Date : July 2, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________
Problem Description:
Updated apache-mod_security packages fix security vulnerability: When ModSecurity receives a request body with a size bigger than the value set by the SecRequestBodyInMemoryLimit and with a Content-Type that has no request body processor mapped to it, ModSecurity will systematically crash on every call to forceRequestBodyVariable (in phase 1) (CVE-2013-2765). _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2765 http://advisories.mageia.org/MGASA-2013-0179.html _______________________________________________________________________
Updated Packages:
Mandriva Enterprise Server 5: d96691d5037b826c0ef3977a1e2bb22b mes5/i586/apache-mod_security-2.5.12-0.5mdvmes5.2.i586.rpm 3c61a5602aa5bf2727fb1a4114f5be91 mes5/i586/mlogc-2.5.12-0.5mdvmes5.2.i586.rpm 955ef3d68ba21db4909a61623eb9a24c mes5/SRPMS/apache-mod_security-2.5.12-0.5mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64: eb0232716c8057ed7d03f461d4f4233d mes5/x86_64/apache-mod_security-2.5.12-0.5mdvmes5.2.x86_64.rpm f138a1c5b019df8b80b48fc084c44432 mes5/x86_64/mlogc-2.5.12-0.5mdvmes5.2.x86_64.rpm 955ef3d68ba21db4909a61623eb9a24c mes5/SRPMS/apache-mod_security-2.5.12-0.5mdvmes5.2.src.rpm
Mandriva Business Server 1/X86_64: 6c22d83dc3a60409f00ab408646d2de3 mbs1/x86_64/apache-mod_security-2.6.3-5.3.mbs1.x86_64.rpm eef3d933ed0d9bfbe05faca382446f7d mbs1/x86_64/mlogc-2.6.3-5.3.mbs1.x86_64.rpm 61f6889bf73f70137571c8ceb29c9516 mbs1/SRPMS/apache-mod_security-2.6.3-5.3.mbs1.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFR0obfmqjQ0CJFipgRAgxoAJ0b36mh6rUuaxM4kOWWSY5rIWU8zACfT5Y5 KB1jMfsMIw5K4b7ZKax32BY= =23/c -----END PGP SIGNATURE-----
------------=_1372763027-2483-23 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________
------------=_1372763027-2483-23--
|
|
|
|