CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
Confidence
High
EPSS
Percentile
98.9%
A remotely exploitable denial-of-service vulnerability exists in the Apache HTTP Server. Exploitation of this vulnerability may allow an attacker to consume all available system resources, resulting in a denial-of-service condition.
206537
Filter by status: All Affected Not Affected Unknown
Filter by content: __Additional information available
__Sort by: Status Alphabetical
Expand all
Javascript is disabled. Clickhere to view vendors.
Updated: April 08, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see http://www.apache.org/dist/httpd/Announcement2.html.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 11, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see http://lists.apple.com/mhonarc/security-announce/msg00028.html.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: May 01, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
`- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : apache
SUMMARY : Denial of service vulnerability
DATE : 2003-04-30 14:48:00
ID : CLA-2003:632
RELEVANT
RELEASES : 9
- -------------------------------------------------------------------------
DESCRIPTION
Apache[1] is the most popular webserver in use today.`
This update fixes two security vulnerabilities:
1. Denial of service (CAN-2003-0132)[3] David Endler from iDefense reported[2] a denial of service condition that affects the apache 2.0 branch which affects all unpatched servers up to and including version 2.0.44.
There is a memory leak in these apache versions which can be remotely triggered by sending large chunks of consecutive linefeed characters. Each linefeed will cause the server to allocate 80 bytes of memory.
A remote attacker can keep sending these simple requests until the server's memory is exhausted.
2. File descriptor leak[5] Christian Kratzer and Bjoern A. Zeeb identified several file descriptor leaks to child processes, such as CGI scripts, which could consitute a security threat on servers that run untrusted CGI scripts.
The Apache HTTP Server Project released[4] Apache version 2.0.45 to address these issues, and this is the version provided via this update.
SOLUTION It is recommended that all Apache users upgrade their packages.
IMPORTANT: it is necessary to manually restart the httpd server after upgrading the packages. In order to do this, execute the following as root:
service apache stop
(wait a few seconds and check with "ps ax|grep httpd" if there are any httpd processes running. On a busy webserver this could take a little longer)
service apache start
`REFERENCES
http://httpd.apache.org/
http://www.idefense.com/advisory/04.08.03.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132
http://www.apache.org/dist/httpd/Announcement2.html
UPDATED PACKAGES ``ftp://atualizacoes.conectiva.com.br/9/SRPMS/apache-2.0.45-28790U90_1cl.src.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-2.0.45-28790U90_1cl.i386.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-devel-2.0.45-28790U90_1cl.i386.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-doc-2.0.45-28790U90_1cl.i386.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-htpasswd-2.0.45-28790U90_1cl.i386.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr-devel-2.0.45-28790U90_1cl.i386.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr-devel-static-2.0.45-28790U90_1cl.i386.rpm`` ``ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr0-2.0.45-28790U90_1cl.i386.rpm``
ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades:
`- run: apt-get update
Detailed instructions reagarding the use of apt and upgrade examples can be found at ``http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at ``http://distro.conectiva.com.br/seguranca/chave/?idioma=en`` Instructions on how to check the signatures of the RPM packages can be found at ``http://distro.conectiva.com.br/seguranca/politica/?idioma=en``
- ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at ``http://distro.conectiva.com.br/atualizacoes/?idioma=en``
- ------------------------------------------------------------------------- Copyright (c) 2003 Conectiva Inc. ``http://www.conectiva.com``
- ------------------------------------------------------------------------- subscribe: [email protected] unsubscribe: [email protected] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see ``http://www.gnupg.org``
iD8DBQE+sAyO42jd0JmAcZARAoRzAJ4/YiZhEH/a5PKSls5bXKbPDI0bSwCdFjWO yLHZiBj+wWOkv+2DLxpHjHI= =AIKW -----END PGP SIGNATURE-----
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Updated: April 08, 2003
Affected
Neither the stable nor the old stable distributions are affected by this problem. Apache 2 is only part of the unstable distribution and version 2.0.45-2 has been uploaded including the fix. Any package with a version of 2.0.45-2 or higher are fixed.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Updated: April 09, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
Please see GLSA 200304-01.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: September 18, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
----------------------------------------------------------------- **REVISED 01** Source: HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0304-256 Originally issued: 25 April 2003 Last Revised: 03 Sept. 2003 SSRT3534 Potential Security Vulnerabilities in Apache HTTP Server
(rev. 1) -----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this Bulletin provided that it remains complete and intact.
The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible.
----------------------------------------------------------------- PROBLEM: 1. A memory leak in Apache 2.0 through 2.0.44 potentially
allows remote attackers to cause a denial of service (memory consumption).
More details are available at: <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132>
2. Apache httpd fails to close access and error logs when it forks and execs cgi scripts. This fix depends on the APR library release 0.9.2 or later.
More details are available at: <http://nagoya.apache.org/bugzilla/index.html> BUG #17206
IMPACT: Potential information leak and Denial of Service
PLATFORM: HP9000 Servers running HP-UX release 11.00, 11.11, and 11.22 with versions of the following products are affected, and represented as:
product-name, version (product-tag/bundle-tag)
- hp apache-based web server, 2.0.43.04 or earlier (HPApache/B9416AA, HPApache/B9416BA) This product includes Apache 2.0.43.
- hp-ux apache-based web server, v.1.0.02.01 or earlier (hpuxwsAPACHE/hpuxwsApache) This product includes Apache 2.0.43.
SOLUTION: For HP-UX releases 11.00, 11.11 and 11.22 download new HP Apache product from <http://www.software.hp.com/>:
For HPApache/B9416AA, HPApache/B9416BA and hpuxwsAPACHE/hpuxwsApache download the following:
- hp-ux apache-based web server, v.1.0.03.01 or later (hpuxwsAPACHE/hpuxwsApache) This product includes Apache 2.0.45.
<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/ cgi/displayProductInfo.pl?productNumber=HPUXWSSUITE>
**REVISED 01**
--->> NOTE: The IPv6 solution is now available. Please refer to --->> documentation and depot's available from software.hp.com --->> Click on "internet ready and networking" --->> and look for "hp-ux apache-based web server --->> v.1.0.07.01 for ipv6 powered by apache, tomcat, webmin.
MANUAL ACTIONS: Yes - Update Install the product containing the fix. For customers with HPApache/B9416AA or HPApache/B9416BA installed, the fix requires migration to hpuxwsAPACHE/hpuxwsApache and removing the affected products from the system.
AVAILABILITY: Complete product bundles are available now on <http://www.software.hp.com/>
** REVISED 01** CHANGE SUMMARY: Rev.01 Added updated IPv6 information
----------------------------------------------------------------- A. Background
The Common Vulnerabilities and Exposures project <http://cve.mitre.org/> has identified potential vulnerabilities
in the Apache HTTP Server (CAN-2003-0132). These affect the following HP product numbers/versions on HP-UX releases 11.00, 11.11 and 11.22:
- hp apache-based web server, 2.0.43.04 or earlier (HPApache/B9416AA, HPApache/B9416BA)
- hp-ux apache-based web server, v.1.0.02.01 or earlier (hpuxwsAPACHE/hpuxwsApache)
B. Recommended solution The Apache Software Foundation has released Apache 2.0.45 as the best known version that fixes the problems identified in the above mentioned issues.
`For customers using HPApache/B9416AA, HPApache/B9416BA and
hpuxwsAPACHE/hpuxwsApache, HP has incorporated Apache 2.0.45
in the following product:
<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/**REIVSED 01**
--->> NOTE: The IPv6 solution is now available. Please refer to --->> documentation and depot's available from software.hp.com --->> Click on "internet ready and networking" --->> and look for "hp-ux apache-based web server --->> v.1.0.07.01 for ipv6 powered by apache, tomcat, webmin.
To determine if the Apache web server from HP is installed on
your system, use Software Distributor’s swlist command. All
three versions products may co-exist on a single system.`
For example, the results of the command swlist -l product | grep -i apache
HPApache 2.0.39.01.02 HP Apache-based Web Server hpuxwsAPACHE A.1.0.01.01 HP-UX Apache-based Web Server
Before updating, make sure to stop any previous Apache binary.
Otherwise, the previous binary will continue running,
preventing the new one from starting, although the
installation would be successful.`
After determining which Apache is installed, stop Apache with the following commands:
for HPApache: /opt/hpapache2/bin/apachectl stop for hpuxwsAPACHE: /opt/hpws/apache/bin/apachectl stop
mentioned links.
value specified on the installation web page.
installed, migrate to hpuxwsAPACHE/hpuxwsApache andInstallation of this new version of HP Apache over an existing HP Apache installation is supported, while installation over a non-HP Apache is NOT supported.
If you rather remove Apache from your system than install a
newer version to resolve the security problem, use both
Software Distributor’s “swremove” command and also “rm -rf”
the home location as specified in the rc.config.d file “HOME”
variables.`
To find the files containing HOME variables in the /etc/rc.config.d directory:
%ls /etc/rc.config.d | grep apache hpapache2conf hpws_apacheconf
C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP IT Resource Center via electronic mail, do the following:
Use your browser to get to the HP IT Resource Center page at:
<http://itrc.hp.com>
Use the 'Login' tab at the left side of the screen to login using your ID and password. Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC. Remember to save the User ID assigned to you, and your password.
In the left most frame select "Maintenance and Support".
Under the "Notifications" section (near the bottom of the page), select "Support Information Digests".
To -subscribe- to future HP Security Bulletins or other Technical Digests, click the check box (in the left column) for the appropriate digest and then click the "Update Subscriptions" button at the bottom of the page.
or
To -review- bulletins already released, select the link (in the middle column) for the appropriate digest.
NOTE: Using your itrc account security bulletins can be found here:
<http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin>
To -gain access- to the Security Patch Matrix, select the link for "The Security Bulletins Archive". (near the bottom of the page) Once in the archive the third link is to the current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. Security Patch Check completely automates the process of reviewing the patch matrix for 11.XX systems. Please note that installing the patches listed in the Security Patch Matrix will completely implement a security bulletin _only_ if the MANUAL ACTIONS field specifies "No."
The Security Patch Check tool can verify that a security bulletin has been implemented on HP-UX 11.XX systems providing that the fix is completely implemented in a patch with no manual actions required. The Security Patch Check tool cannot verify fixes implemented via a product upgrade.
For information on the Security Patch Check tool, see: <http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/ displayProductInfo.pl?productNumber=B6834AA>
The security patch matrix is also available via anonymous ftp:
ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/
On the "Support Information Digest Main" page: click on the "HP Security Bulletin Archive".
The PGP key used to sign this bulletin is available from several PGP Public Key servers. The key identification information is:
2D2A7D59 HP Security Response Team (Security Bulletin signing only) <[email protected]> Fingerprint =
6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59
If you have problems locating the key please write to [email protected]. Please note that this key is for signing bulletins only and is not the key returned by sending 'get key' to [email protected].
D. To report new security vulnerabilities, send email to
[email protected]
Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of 'get key' (no quotes) to [email protected].
-----------------------------------------------------------------
(c)Copyright 2003 Hewlett-Packard Company Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of HP products referenced herein are trademarks and/or service marks of Hewlett-Packard Company. Other product and company names mentioned herein may be trademarks and/or service marks of their respective owners.
________________________________________________________________
-----BEGIN PGP SIGNATURE----- Version: PGP 8.0
iQA/AwUBP1aBUOAfOvwtKn1ZEQJBhgCfVCie2gIk+c6b3SYTDwr5MwzlnjUAmwey jsh4S/bDsQK3nMvlTgGhS+yr =/3d2 -----END PGP SIGNATURE-----
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: September 18, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
________________________________________________________________________
`Mandrake Linux Security Update Advisory
Package name: apache2
Advisory ID: MDKSA-2003:050
Date: April 22nd, 2003
Affected versions:9.1
Problem Description:
A memory leak was discovered in Apache 2.0 through 2.0.44 that can
allow a remote attacker to cause a significant denial of service
(DoS) by sending requests containing a lot of linefeed characters to
the server.`
As well, Apache does not filter terminal escape sequences from its log files, which could make it easy for an attacker to insert those sequences into the error and access logs, which could possibly be viewed by certain terminal emulators with vulnerabilities related to escape sequences.
After upgrading these packages, be sure to restart the httpd server by executing:
`service httpd restart
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0083
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132`
________________________________________________________________________
Updated Packages:
Mandrake Linux 9.1: ad53df84893a5cc1114c3de55cc91658 9.1/RPMS/apache2-2.0.45-4.2mdk.i586.rpm 60d8447552d758bc3565450f08b79bfe 9.1/RPMS/apache2-common-2.0.45-4.2mdk.i586.rpm 3060613a3a072d9fffc9bbfd0a994581 9.1/RPMS/apache2-devel-2.0.45-4.2mdk.i586.rpm 36504391b61565e9607a70c2d42a3b6a 9.1/RPMS/apache2-manual-2.0.45-4.2mdk.i586.rpm b1778fe2310da4c8c94fcdefb6856ccd 9.1/RPMS/apache2-mod_dav-2.0.45-4.2mdk.i586.rpm f7b614162bad34d2778b8621d7878641 9.1/RPMS/apache2-mod_ldap-2.0.45-4.2mdk.i586.rpm e8c3e2db532f8c2c94b5ef05bab0ce85 9.1/RPMS/apache2-mod_ssl-2.0.45-4.2mdk.i586.rpm 2f56e31ce758a96a1c9fd8060eba4d1a 9.1/RPMS/apache2-modules-2.0.45-4.2mdk.i586.rpm 69029f8e2bda1254c6f469df9eace7f7 9.1/RPMS/apache2-source-2.0.45-4.2mdk.i586.rpm 43999a817273e73e901f8bf8ff05389f 9.1/RPMS/libapr0-2.0.45-4.2mdk.i586.rpm ab454d8e8e1d9c3f51a98ad2aaa4cffc 9.1/SRPMS/apache-conf-2.0.45-2.1mdk.src.rpm c11d11afb80fba23925632089a70bc00 9.1/SRPMS/apache2-2.0.45-4.2mdk.src.rpm
Mandrake Linux 9.1/PPC: b9db2f91c7937244acb2d32f34ae9241 ppc/9.1/RPMS/apache2-2.0.45-4.2mdk.ppc.rpm 3bc96cd24d6bd3b307222d81fce9f4ca ppc/9.1/RPMS/apache2-common-2.0.45-4.2mdk.ppc.rpm 60e4187ec0b293f25a9008c13c527c1a ppc/9.1/RPMS/apache2-devel-2.0.45-4.2mdk.ppc.rpm a3c3322b834790fc1da3c8e7f0901168 ppc/9.1/RPMS/apache2-manual-2.0.45-4.2mdk.ppc.rpm 352b82414ec0362eaa9c7ea451261a60 ppc/9.1/RPMS/apache2-mod_dav-2.0.45-4.2mdk.ppc.rpm a537dc5489a82099cb87b24f3718e11c ppc/9.1/RPMS/apache2-mod_ldap-2.0.45-4.2mdk.ppc.rpm e6736e2c450bc76382cceaf7116e1616 ppc/9.1/RPMS/apache2-mod_ssl-2.0.45-4.2mdk.ppc.rpm f5b6f2d90cb73845987624c7ffd514a3 ppc/9.1/RPMS/apache2-modules-2.0.45-4.2mdk.ppc.rpm dca30abc0adead3a22c5fd3a82df8d20 ppc/9.1/RPMS/apache2-source-2.0.45-4.2mdk.ppc.rpm f33cdee67bd82884bd6d77c551320961 ppc/9.1/RPMS/libapr0-2.0.45-4.2mdk.ppc.rpm ab454d8e8e1d9c3f51a98ad2aaa4cffc ppc/9.1/SRPMS/apache-conf-2.0.45-2.1mdk.src.rpm c11d11afb80fba23925632089a70bc00 ppc/9.1/SRPMS/apache2-2.0.45-4.2mdk.src.rpm
________________________________________________________________________
`Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you.
If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with “rpm -Fvh *.rpm”. A list of
FTP mirrors can be obtained from:
http://www.mandrakesecure.net/en/ftp.php
Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:
rpm --checksig <filename>
All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team from:
https://www.mandrakesecure.net/RPM-GPG-KEYS
Please be aware that sometimes it takes the mirrors a few hours to
update.
You can view other update advisories for Mandrake Linux at:
http://www.mandrakesecure.net/en/advisories/
MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
visiting:
http://www.mandrakesecure.net/en/mlist.php
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)
mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPaIRgQQEQIA
BgUCPI+UAwAKCRDniYrgcHcf8xK5AKCm/Mq8qP8GE0o1hEX22QsJMZwH5gCfZ72H
8TacOb3oAmBdprf+K6gkdOiIRgQQEQIABgUCOtOieAAKCRCv2bZyU0yB80MeAJ9K
+jXt0cKuaUonRU+CRGetk6t9dgCfTRRL6/puOKdD6md70+K5EBBSvsG0OE1hbmRy
YWtlIExpbnV4IFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QG1hbmRyYWtlc29mdC5j
b20+iFcEExECABcFAjyPnuUFCwcKAwQDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmFi+
AJsHhohgnU3ik4+gy3EdFlB2i/MBoACg6lHn5cnVvTcmgNccWxeNxLLZI5e5AQ0E
OWnn7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ
9F779FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzR
xBXVJb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z
269s+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN
6SCXVl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZ
jTcl3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo
0NAiRYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJ
EJGXlA==
=yGlX
-----BEGIN PGP SIGNATURE-----
iD8DBQE+pcY0mqjQ0CJFipgRAs4KAKCMHUCeQJqs/XlZYTXZg/kL4Pfe9ACfdbLkIf you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 10, 2003
Affected
Red Hat Linux 8.0 and Red Hat Linux 9 ship with a httpd package that includes Apache 2 and are therefore vulnerable to this issue. Updated httpd packages are available along with our advisory at the URL below. Users of the Red Hat Network can update their systems using the ‘up2date’ tool.
http://rhn.redhat.com/errata/RHSA-2003-139.html
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: September 18, 2003
Affected
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________ SGI Security Advisory
`Title : Security Vulnerabilities in MediaBase Apache and PHP
Number : 20030502-01-I
Date : May 19, 2003
Reference: Kasenna Support Issue # 1095 and # 1330
Fixed in : Patches from Kasenna Support Website
- -----------------------
It’s been reported that Kasenna Mediabase has insecure versions of
Apache and PHP.
SGI has investigated the issue and recommends the following steps for
neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures
be implemented on ALL vulnerable SGI systems.
These issues have been corrected with patches and in future releases of
MediaBase.
`
`- --------------
MediaBase is an optional product from Kasenna, and is not installed by
default on IRIX 6.5 systems.
To determine the version of IRIX you are running, execute the following
command:
# /bin/uname -R
That will return a result similar to the following:
# 6.5 6.5.16f
The first number (“6.5”) is the release name, the second (“6.5.16f” in this
case) is the extended release name. The extended release name is the
“version” we refer to throughout this document.
To see if mediabase is installed, execute the following command:
% versions -b | grep mbase
I mbase_client 06/01/2000 WebFORCE MediaBase 2.1 - Client
I mbase_players 10/06/2000 SGI MediaBase 4.0.1 - Players packaged
for installation on server
I mbase_root 12/24/2000 SGI MediaBase 4.0.1 - Development ROOT
Files
I mbase_server 10/06/2000 SGI MediaBase 4.0.1 - MediaBase Server
Execution Environment
I mbase_server_spk1 12/24/2000 SGI MediaBase 4.0.1 - MediaBase Server
Service Pack 1
To determine if the version of Apache installed as part of MediaBase is
vulnerable, execute the following command:
% /usr/kasenna/apache/bin/httpd -v
Server version: Apache/1.3.14 (Unix)
Server built: Dec 20 2000 15:52:52`
If the version shown (in this case 1.3.14) is lower than 1.3.27, then the system is vulnerable.
To determine if the version of PHP installed as part of MediaBase is vulnerable, execute the following commands:
%/usr/bin/elfdump -L /usr/mbase/asset_gateway/php_apache.so | grep TIMSTAMP [46] TIMSTAMP Jan 13 14:50:39 2003
%/usr/bin/elfdump -L /usr/mbase/asset_gateway/php_mediabase.so | grep TIMSTAMP [45] TIMSTAMP Jan 10 14:02:48 2003
If the value shown for "TIMSTAMP" is earlier than the ones shown, then the system is vulnerable.
`- ----------------------------
There is no effective workaround available for these problems if MediaBase
is needed. SGI and Kasenna recommend installing the patches shown below
from the Kasenna website.
`
`- ----------------
Kasenna MediaBase is an optional product, the system is vulnerable if
a vulnerable version of MediaBase and its associated Apache and PHP
components are installed. Please run the commands shown in the “Impact”
section above and install the patches if those commands show
the system to be vulnerable.
Kasenna has provided patches for these vulnerabilities. Our recommendation
is to install the patches provided by Kasenna.
To obtain the Kasenna MediaBase patches, go to http://support.kasenna.com/
and install the patches shown in support issue 1095 (apache) and 1033 (PHP).
`
`- ------------------------
SGI wishes to thank FIRST and the users of the Internet Community at large
for their assistance in this matter.
`
`- -------------
SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/
SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/
SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/ and ftp://patches.sgi.com/
SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/
SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/
SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/
SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/
IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/ and ftp://patches.sgi.com/support/patchset/
IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/
IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/
The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com. Security advisories and patches are located under the URL
ftp://patches.sgi.com/support/free/security/
For security and patch management reasons, ftp.sgi.com (mirrors
patches.sgi.com security FTP repository) lags behind and does not do a
real-time update.
`
`- -----------------------------------------
If there are questions about this document, email can be sent to
[email protected].
------oOo------
SGI provides security information and patches for use by the entire SGI
community. This information is freely available to any person needing the
information and is available via anonymous FTP and the Web.
The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com. Security advisories and patches are located under the URL
ftp://patches.sgi.com/support/free/security/
The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/
For issues with the patches on the FTP sites, email can be sent to
[email protected].
For assistance obtaining or working with security patches, please
contact your SGI support provider.
------oOo------
SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email) all
SGI Security Advisories when they are released. Subscribing to the mailing
list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html) or by sending email to
SGI as outlined below.
% mail [email protected]
subscribe wiretap <YourEmailAddress such as [email protected] >
end
^d
In the example above, <YourEmailAddress> is the email address that you wish
the mailing list information sent to. The word end must be on a separate
line to indicate the end of the body of the message. The control-d (^d) is
used to indicate to the mail program that you are finished composing the
mail message.
`
------oOo------
SGI provides a comprehensive customer World Wide Web site. This site is located at http://www.sgi.com/support/security/ .
------oOo------
If there are general security questions on SGI systems, email can be sent to [email protected].
For reporting *NEW* SGI security issues, email can be sent to [email protected] or contact your SGI support provider. A support contract is not required for submitting a security report.
______________________________________________________________________________ This information is provided freely to all interested parties and may be redistributed provided that it is not altered in any way, SGI is appropriately credited and the document retains and includes its valid PGP signature.
-----BEGIN PGP SIGNATURE----- Version: 2.6.2
iQCVAwUBPsk2RLQ4cFApAP75AQEJ/AP/WEMo5vC7eqGVrHFnuJlozO26m6n2yNR7 qUla/iyvXonSCrL6D6ar8kKt7qnpodIq4r6wmD2x/Mapwd2xmm2DgsDCxPwjzj// UgFJqBKEaHkL3CTo0RYSnYEwQ7xvQWBJSMx4dRYwoEnBKl1hEI3CHzcfkeNEhEhT 9xdFKv9jjHA= =4cPh -----END PGP SIGNATURE-----
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Not Affected
We do not ship Apache 2.x in any of our products, so we are not vulnerable to this issue.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 10, 2003
Not Affected
Foundry Networks is currently not shipping any products with Apache 2.x. Foundry Networks is not affected by the Apache vulnerability described in CERT VU#206537.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 17, 2003
Not Affected
Fujitsu’s UXP/V o.s. is not affected by the problem in VU#206537 because it does not support the Apache.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 14, 2003
Not Affected
Hitachi Web Server is NOT vulnerable, because it is not based on Apache 2.x.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Not Affected
The AIX operating system does not ship with the Apache web server. The AIX operating system is not vulnerable to the issues discussed in CERT vulnerability note VU#206537.
The AIX Toolbox For Linux does not ship with a vulnerable version of the Apache web server. Please note that the AIX Toolbox for Linux is shipped “as is” and is unwarranted.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: May 30, 2003
Not Affected
A response to this vulnerability is available from our web site:
http://www.xerox.com/security.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: July 24, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 08, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Notified: April 08, 2003 Updated: April 09, 2003
Unknown
We have not received a statement from the vendor.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
View all 58 vendors __View less vendors __
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This vulnerability was discovered by iDEFENSE Inc. The CERT/CC thanks iDEFENSE Inc. for the information contained in their document, upon which this document is based.
This document was written by Ian A Finlay.
CVE IDs: | CVE-2003-0132 |
---|---|
Severity Metric: | 9.72 Date Public: |
httpd.apache.org/download.cgi
marc.theaimsgroup.com/?l=bugtraq&m=104931360606484&w=2
news.zdnet.co.uk/story/0,,t269-s2132975,00.html?rtag=zdnetukhompage
www.businessweek.com/technology/cnet/stories/995309.htm
www.idefense.com/advisory/04.08.03.txt
www.idg.com.sg/idgwww.nsf/unidlookup/315B17C00BE0ADBD48256CFE0013EEFB?OpenDocument
www.neowin.net/comments.php?id=10012&category=main
www.nwfusion.com/news/2003/0403newapach.html
www.pcworld.com/news/article/0,aid,110142,00.asp
www.theregister.co.uk/content/55/30126.html
www.vnunet.com/News/1139961