[FLSA-2004:1325] Updated mod_python packages fix security vulnerability

From: Dominic Hargreaves (dom_at_earth.li)
Date: 10/03/04

  • Next message: Clairmont, Jan M: "[Full-Disclosure] Shows when no limits are set or restricted shell or bat access" 
    Date: Sun, 3 Oct 2004 13:47:53 +0100
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com

    -----------------------------------------------------------------------
                   Fedora Legacy Update Advisory

    Synopsis: Updated mod_python resolves security vulnerability
    Advisory ID: FLSA:1325
    Issue date: 2004-10-03
    Product: Red Hat Linux
    Keywords: Security
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1325
    CVE Names: CAN-2003-0973
    -----------------------------------------------------------------------

    -----------------------------------------------------------------------
    1. Topic:

    Updated mod_python packages that fix a security vulnerability are now
    available.

    mod_python embeds the Python language interpreter within the Apache httpd
    server.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386

    3. Problem description:

    A bug has been found in mod_python versions 3.0.3 and earlier that can
    lead to a denial of service vulnerability. The Common Vulnerabilities and
    Exposures project (cve.mitre.org) has assigned the name CAN-2003-0973 to
    this issue.

    mod_python users are advised to upgrade to these errata packages,
    which contain a backported patch that corrects this bug.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which are
    not installed but included in the list will not be updated. Note that you
    can also use wildcards (*.rpm) if your current directory *only* contains
    the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the appropriate
    RPMs being upgraded on your system. This assumes that you have yum or
    apt-get configured for obtaining Fedora Legacy content. Please visit
    http://www.fedoralegacy.org/docs/ for directions on how to configure yum
    and apt-get.

    5. Bug IDs fixed:

    http://bugzilla.fedora.us - 1325 - mod_python: denial of service
    vulnerability.

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mod_python-2.7.8-1.7.3.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/mod_python-2.7.8-1.7.3.2.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------------

    49aa1436fc8982e616b5957554485e278d772f9b 7.3/updates/SRPMS/mod_python-2.7.8-1.7.3.2.legacy.src.rpm
    1cb0e3eccd14fbfb220bf26259b509ff17ed9eec 7.3/updates/i386/mod_python-2.7.8-1.7.3.2.legacy.i386.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy org/about/security.php

    You can verify each package with the following command:

        rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

        sha1sum <filename>

    8. References:

    https://rhn.redhat.com/errata/RHSA-2004-063.html
    http://www.modpython.org/pipermail/mod_python/2003-November/014532.html

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

  • Next message: Clairmont, Jan M: "[Full-Disclosure] Shows when no limits are set or restricted shell or bat access"

    Relevant Pages