mod_ssl

New modssl packages are available for Slackware 8.1, 9.0, 9.1, and -current to fix a security issue. The packages were upgraded to modssl-2.8.18-1.3.31 fixing a buffer overflow that may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN, if modssl is...

mod_ssl ssl_util_uuencode_binary Remote Overflow

The remote host is using a version of modssl that is older than 2.8.18. This version is vulnerable to a flaw that could allow an attacker to disable the remote website remotely, or to execute arbitrary code on the remote host. Note that several Linux distributions patched the old version of this...

CVE-2004-0488

The provided documents confirm CVE-2004-0488: a stack-based buffer overflow in the ssl_util_uuencode_binary function of ssl_util.c used by Apache mod_ssl when configured to trust the issuing CA. This can allow remote code execution via a client certificate with a long subject DN. The issue affect...

CVE-2004-0488

Stack-based buffer overflow in the sslutiluuencodebinary function in sslutil.c for Apache modssl, when modssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN...

CVE-2004-0488

Stack-based buffer overflow in the sslutiluuencodebinary function in sslutil.c for Apache modssl, when modssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN...

[Full-Disclosure] [RHSA-2004:182-01] Updated httpd packages fix mod_ssl security issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated httpd packages fix modssl security issue Advisory ID: RHSA-2004:182-01 Issue date: 2004-04-30 Updated on: 2004-04-30 Product: Red Hat...

CVE-2004-0113

Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service memory consumption via plain HTTP requests to the SSL port of an SSL-enabled server...

Multiple Apache vulnerabilities

modssl memory leak, logfile terminal escape sequences injection...

Important: Red Hat Security Advisory: httpd security update

Updated httpd packages are now available that fix a denial of service vulnerability in modssl and include various other bug fixes. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. A memory leak in modssl in the Apache HTTP Server prior to version...

Apache 2.0.x < 2.0.49 mod_ssl Plain HTTP Request DoS

The remote host appears to be running a version of Apache 2.0.x prior to 2.0.49. It is, therefore, affected by a denial of service vulnerability in the 'modssl' module. An attacker can exploit this to deny service to the Apache server. C Tenable Network Security, Inc. include"compat.inc"; if...

Apache 2 mod_ssl denial-of-service

Joe Orton reports a memory leak in Apache 2's modssl. A remote attacker may issue HTTP requests on an HTTPS port, causing an error. Due to a bug in processing this condition, memory associated with the connection is not freed. Repeated requests can result in consuming all available memory...

Apache Httpd < 2.0.49 : mod_ssl memory leak

A memory leak in modssl allows a remote denial of service attack against an SSL-enabled server by sending plain HTTP requests to the SSL port...

apache security update

Apache httpd is a hypertext transfer protocol server, and is used by over two thirds of the Internet's web sites. Upgraded Apache packages are available for Slackware 8.1, 9.0, 9.1, and -current. These fix local vulnerabilities that could allow users who can create or edit Apache config files to...

Moderate: Red Hat Security Advisory: mod_ssl security update for Stronghold

An updated modssl package is now available for Stronghold 4 on Red Hat Enterprise Linux that closes a security issue in certain rare configurations. Stronghold 4 contains a number of open source technologies, including the modssl module which provides SSL/TLS support for Apache. Ben Laurie found ...

Moderate: Red Hat Security Advisory: mod_ssl, openssl security update for Stronghold

Updated versions of Stronghold 4 cross-platform are available that fix several security issues affecting OpenSSL and modssl. A number of bug fixes and new features are also included. Stronghold 4 contains a number of open source technologies, including OpenSSL 0.9.6 and modssl. NISCC testing of...

Moderate: Red Hat Security Advisory: apache security update

Updated Apache and modssl packages that fix several minor security issues are now available for Red Hat Enterprise Linux. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Ben Laurie found a bug in the optional renegotiation code in modssl which can...

Moderate: Red Hat Security Advisory: : Updated Apache and mod_ssl packages fix security vulnerabilities

Updated Apache and modssl packages that fix several minor security issues are now available for Red Hat Linux 7.1, 7.2, and 7.3. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Ben Laurie found a bug in the optional renegotiation code in modssl whi...

CVE-2003-0192

Apache 2 before 2.0.47, and certain versions of modssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite...

CVE-2003-0192

CVE-2003-0192 describes an issue in Apache 2.x before 2.0.47 (and mod_ssl for Apache 1.3) where certain sequences of per-directory renegotiations combined with using SSLCipherSuite to upgrade a weak cipher could cause the server to continue using a weak cipher. The connected advisories confirm af...

CVE-2003-0192

Apache 2 before 2.0.47, and certain versions of modssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause Apache to use the weak ciphersuite...