Mandrake Linux Security Advisory : mod_ssl/apache2-mod_ssl (MDKSA-2004:122)

A vulnerability in modssl was discovered by Hartmut Keil. After a renegotiation, modssl would fail to ensure that the requested cipher suite is actually negotiated. The provided packages have been patched to prevent this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptiv...

[slackware-security] apache+mod_ssl

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix a security issue. Apache has been upgraded to version 1.3.33 which fixes a buffer overflow which may allow local users to execute arbitrary code as the apache user. The modssl package has also been upgraded t...

FreeBSD : mod_ssl -- SSLCipherSuite bypass (112)

The following package needs to be updated: apache+modssl+ipv6 %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg4238151d207a11d9bfe20090962cff2a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML :...

[slackware-security] apache, mod_ssl, php

New apache and modssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix security issues. Apache has been upgraded to version 1.3.32 which fixes a heap-based buffer overflow in modproxy. modssl was upgraded from version modssl-2.8.19-1.3.31 to version 2.8.21-1.3.32 whic...

GLSA-200410-21 : Apache 2, mod_ssl: Bypass of SSLCipherSuite directive

The remote host is affected by the vulnerability described in GLSA-200410-21 Apache 2, modssl: Bypass of SSLCipherSuite directive A flaw has been found in modssl where the 'SSLCipherSuite' directive could be bypassed in certain configurations if it is used in a directory or location context to...

Apache 2, mod_ssl: Bypass of SSLCipherSuite directive

Background The Apache HTTP server is one of the most popular web servers on the internet. modssl provides SSL v2/v3 and TLS v1 support for Apache 1.3 and is also included in Apache 2. Description A flaw has been found in modssl where the "SSLCipherSuite" directive could be bypassed in certain...

CVE-2004-0751

The charbufferread function in the modssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service segmentation fault...

CVE-2004-0748

modssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service CPU consumption by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop...

CVE-2004-0748

modssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service CPU consumption by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop...

CVE-2004-0751

The charbufferread function in the modssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service segmentation fault...

CVE-2004-0748

modssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service CPU consumption by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop...

CVE-2004-0751

The charbufferread function in the modssl module for Apache 2.x, when using reverse proxying to an SSL server, allows remote attackers to cause a denial of service segmentation fault...

CVE-2004-0885

The CVE-2004-0885 entry describes a vulnerability in Apache's mod_ssl for versions 2.0.35–2.0.52 where, when using SSLCipherSuite in directory or location context, remote clients can bypass intended restrictions by selecting any cipher suite allowed by the virtual host configuration. The initial ...

CVE-2004-0885

The modssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration...

CVE-2004-0885

The modssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration...

Apache mod_ssl format string bug

Format string bug if modssl is used in conjunction with modproxy for SSL proxing https://foos.example.com/...

Apache Httpd < 2.0.53 : SSLCipherSuite bypass

An issue has been discovered in the modssl module when configured to use the "SSLCipherSuite" directive in directory or location context. If a particular location context has been configured to require a specific set of cipher suites, then a client will be able to access that location using any...

Debian DSA-120-1 : mod_ssl - buffer overflow

Ed Moyle recently found a buffer overflow in Apache-SSL and modssl. With session caching enabled, modssl will serialize SSL session variables to store them for later use. These variables were stored in a buffer of a fixed size without proper boundary checks. To exploit the overflow, the server mu...

[ANNOUNCE] Apache HTTP Server 2.0.51 Released

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Apache Software Foundation and the The Apache HTTP Server Project are pleased to announce the release of version 2.0.51 of the Apache HTTP Server "Apache". This Announcement notes the significant changes in 2.0.51 as compared to 2.0.50. This versi...

Apache 2, mod_dav: Multiple vulnerabilities

Background The Apache HTTP server is one of most popular web servers on the internet. modssl provides SSL v2/v3 and TLS v1 support for it and moddav is the Apache module for Distributed Authoring and Versioning DAV. Description A potential infinite loop has been found in the input filter of modss...