Security bugs are reported here via bugzilla

[Jason Flatt <jason AT flattfamily.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I just got this from our Local LUG:


- ----------  Forwarded Message  ----------

Subject: [Lvlug] Fwd: [SLL] Apache 1.3 bug (local exploit)
Date: Tuesday, October 28, 2003 8:19 am
From: Stealth <stealth AT thcnet.net>
To: lvlug AT lvlug.org

>Date: Tue, 28 Oct 2003 07:47:53 -0800
>To: Seattle Linux User's Group <linux-list AT ssc.com>
>
>New Apache bugfix out (so new, in fact, that the main web pages have not
>been updated yet) relating to a local config exploit in mod_alias and
>mod_rewrite... kudos to the OpenPKG folk for getting this one out in a
>*hurry*...
>
> >From the looks of it, you're only in dire need of an upgrade if you're
>
>hosting users you don't trust, and even then, with apache running as
>something other than root, the damage would be limited, no?
>
>OpenPKG alert with much linkage:
>
>http://www.openpkg.org/security/OpenPKG-SA-2003.046-apache.html

_______________________________________________
lvlug mailing list
lvlug AT lvlug.org
http://thcnet.net/mailman/listinfo/lvlug

- -------------------------------------------------------

- -- 
Jason Flatt (jason @ flattfamily . com)
Father of five (http://www.flattfamily.com/)
Linux user (http://www.sourcemage.org/)
IRC Nick: Oadae  Channels: #sourcemage, #lvlug  Server: irc.freenode.net
PGP Key: E992213F - 0254 9DB7 BE0E 312D 8352 6E39 0700 FB95 E992 213F
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/np27BwD7lemSIT8RAmAFAJ93EQ5026o/5tSVD3AvE7fIUiwjPQCePxIe
eCpKviVTrLya4FHOYyWdwbo=
=BUSO
-----END PGP SIGNATURE-----