Security bugs are reported here via bugzilla

[Thomas Houssin <thomas.houssin AT gmail.com>]

Synopsis
========
mod_ssl and Apache are vulnerable to a restriction bypass.

Background
==========
Apache is the world's most popular HTTP server, being quite possibly
the best around in terms of functionality, efficiency, security and speed.
The module mod_ssl provides strong cryptography for the Apache 1.3 HTTP
server via the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols by the help of the Open Source SSL/TLS
toolkit OpenSSL, which is based on SSLeay from Eric A. Young and Tim J.
Hudson.

Description
===========
CAN-2005-2700:
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using SSLVerifyClient
optional" in the global virtual host configuration, does not properly
enforce "SSLVerifyClient require" in a per-location context, which
allows remote attackers to bypass intended access restrictions.

Impact
======
If a virtual host is configured using "SSLVerifyClient optional" and a
directive "SSLVerifyClient required" is set for a specific location, an
attacker may be able to access resources that should otherwise be
protected, by not supplying a client certificate when connecting.

Workaround
==========
There is no known workaround at this time.

Affected packages
=================
apache-mod_ssl and apache2 in all grimoires are affected. This is now
fixed in devel, test, stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All apache-mod_ssl users should upgrade to the latest available version:
       # scribe update
       # cast -c apache-mod_ssl

All apache2 users should upgrade to the latest available version:
       # scribe update
       # cast -c apache2

References
==========
 [ 1 ] CAN-2005-2700
       http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
 [ 2 ] MDKSA-2005:161
       http://www.mandriva.com/security/advisories?name=MDKSA-2005:161


-- 
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature