mod_ssl "SSLVerifyClient" Security Bypass Security Issue

mod_ssl "SSLVerifyClient" Security Bypass Security Issue

Secunia Advisory: SA16700
Release Date: 2005-09-05

Critical:
Moderately critical
Impact: Security Bypass

Where: From remote

Solution Status: Vendor Patch

Software: mod_ssl 2.x

Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.

CVE reference: CAN-2005-2700

Description:
A security issue has been reported in mod_ssl, which potentially can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error in enforcing client-based certificate authentication ("SSLVerifyClient require") in per-location context, if "SSLVerifyClient optional" was configured in the global virtual host configuration. This may allow malicious people to bypass client-based certificate authentication and gain unauthorised access to certain web pages.

Solution:
Update to version 2.8.24.
http://www.modssl.org/source/mod_ssl-2.8.24-1.3.33.tar.gz

Provided and/or discovered by:
Reported by vendor.