[ GLSA 200405-22 ] Apache 1.3: Multiple vulnerabilities

From: Kurt Lieber (klieber_at_gentoo.org)
Date: 05/26/04

  • Next message: Jeff Kell: "Re: [Full-Disclosure] Odd packet?" 
    Date: Wed, 26 May 2004 12:32:40 -0400
To: gentoo-announce@lists.gentoo.org

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200405-22
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Normal
         Title: Apache 1.3: Multiple vulnerabilities
          Date: May 26, 2004
          Bugs: #51815
            ID: 200405-22

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    Several security vulnerabilites have been fixed in the latest release
    of Apache 1.3.

    Background
    ==========

    The Apache HTTP Server Project is an effort to develop and maintain an
    open-source HTTP server for modern operating systems. The goal of this
    project is to provide a secure, efficient and extensible server that
    provides services in tune with the current HTTP standards.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 net-www/apache < 1.3.31 >= 1.3.31

    Description
    ===========

    On 64-bit big-endian platforms, mod_access does not properly parse
    Allow/Deny rules using IP addresses without a netmask which could
    result in failure to match certain IP addresses.

    Terminal escape sequences are not filtered from error logs. This could
    be used by an attacker to insert escape sequences into a terminal
    emulater vulnerable to escape sequences.

    mod_digest does not properly verify the nonce of a client response by
    using a AuthNonce secret. This could permit an attacker to replay the
    response of another website. This does not affect mod_auth_digest.

    On certain platforms there is a starvation issue where listening
    sockets fails to handle short-lived connection on a rarely-accessed
    listening socket. This causes the child to hold the accept mutex and
    block out new connections until another connection arrives on the same
    rarely-accessed listening socket thus leading to a denial of service.

    Impact
    ======

    These vulnerabilities could lead to attackers bypassing intended access
    restrictions, denial of service, and possibly execution of arbitrary
    code.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All users should upgrade to the latest stable version of Apache 1.3.

        # emerge sync

        # emerge -pv ">=net-www/apache-1.3.31"
        # emerge ">=net-www/apache-1.3.31"

    References
    ==========

      [ 1 ] CAN-2003-0993
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0993
      [ 2 ] CAN-2003-0020
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020
      [ 3 ] CAN-2003-0987
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0987
      [ 4 ] CAN-2004-0174
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0174

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

         http://security.gentoo.org/glsa/glsa-200405-22.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Technologies, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/1.0

  • Next message: Jeff Kell: "Re: [Full-Disclosure] Odd packet?"

    Relevant Pages