Skip to Content.
Sympa Menu

sm-security - [SM-Security] SECURITY UPDATE for http/apache2

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] SECURITY UPDATE for http/apache2
  • Date: Thu, 16 Sep 2004 10:35:52 -0700

Security update to fix the following bugs:
An input validation issue in IPv6 literal address parsing which can result in
a
negative length parameter being passed to memcpy.
[CAN-2004-0786]

A buffer overflow in configuration file parsing could allow a local user to
gain
the privileges of a httpd child if the server can be forced to parse a
carefully
crafted .htaccess file.
[CAN-2004-0747]

A segfault in mod_ssl which can be triggered by a malicious remote server, if
proxying to SSL servers has been configured.
[CAN-2004-0751]

A potential infinite loop in mod_ssl which could be triggered given particular
timing of a connection abort.
[CAN-2004-0748]

A segfault in mod_dav_fs which can be remotely triggered by an indirect lock
refresh request.
[CAN-2004-0809]

(The full release notes are available at
http://www.apache.org/dist/httpd/Announcement2.html).

The following files are attached for spell http/apache2:
DETAILS
HISTORY

-sandalle

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Attachment: apache2.tar.bz2
Description: application/bzip




Archive powered by MHonArc 2.6.24.

Top of Page