Skip to Content.
Sympa Menu

sm-security - [SM-Security] apache2 / apache-mod_ssl: unauthorized site access

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] apache2 / apache-mod_ssl: unauthorized site access
  • Date: Sat, 24 Sep 2005 01:07:47 +0200

Synopsis
========
mod_ssl and Apache are vulnerable to a restriction bypass.

Background
==========
Apache is the world's most popular HTTP server, being quite possibly
the best around in terms of functionality, efficiency, security and speed.
The module mod_ssl provides strong cryptography for the Apache 1.3 HTTP
server via the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols by the help of the Open Source SSL/TLS
toolkit OpenSSL, which is based on SSLeay from Eric A. Young and Tim J.
Hudson.

Description
===========
CAN-2005-2700:
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using SSLVerifyClient
optional" in the global virtual host configuration, does not properly
enforce "SSLVerifyClient require" in a per-location context, which
allows remote attackers to bypass intended access restrictions.

Impact
======
If a virtual host is configured using "SSLVerifyClient optional" and a
directive "SSLVerifyClient required" is set for a specific location, an
attacker may be able to access resources that should otherwise be
protected, by not supplying a client certificate when connecting.

Workaround
==========
There is no known workaround at this time.

Affected packages
=================
apache-mod_ssl and apache2 in all grimoires are affected. This is now
fixed in devel, test, stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All apache-mod_ssl users should upgrade to the latest available version:
# scribe update
# cast -c apache-mod_ssl

All apache2 users should upgrade to the latest available version:
# scribe update
# cast -c apache2

References
==========
[ 1 ] CAN-2005-2700
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
[ 2 ] MDKSA-2005:161
http://www.mandriva.com/security/advisories?name=MDKSA-2005:161


--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] apache2 / apache-mod_ssl: unauthorized site access, Thomas Houssin, 09/23/2005

Archive powered by MHonArc 2.6.24.

Top of Page