Software Engineering Institute

Updated:  April 08, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see http://www.apache.org/dist/httpd/Announcement2.html.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  April 08, 2003 Updated: April 11, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see http://lists.apple.com/mhonarc/security-announce/msg00028.html.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  April 08, 2003 Updated: May 01, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE   : apache
SUMMARY   : Denial of service vulnerability
DATE      : 2003-04-30 14:48:00
ID        : CLA-2003:632
RELEVANT
RELEASES  : 9

- -------------------------------------------------------------------------

DESCRIPTION
Apache[1] is the most popular webserver in use today.

This update fixes two security vulnerabilities:

1. Denial of service (CAN-2003-0132)[3]
David Endler from iDefense reported[2] a denial of service condition
that affects the apache 2.0 branch which affects all unpatched
servers up to and including version 2.0.44.

There is a memory leak in these apache versions which can be remotely
triggered by sending large chunks of consecutive linefeed characters.
Each linefeed will cause the server to allocate 80 bytes of memory.

A remote attacker can keep sending these simple requests until the
server's memory is exhausted.

2. File descriptor leak[5]
Christian Kratzer and Bjoern A. Zeeb identified several file
descriptor leaks to child processes, such as CGI scripts, which could
consitute a security threat on servers that run untrusted CGI
scripts.

The Apache HTTP Server Project released[4] Apache version 2.0.45 to
address these issues, and this is the version provided via this
update.


SOLUTION
It is recommended that all Apache users upgrade their packages.

IMPORTANT: it is necessary to manually restart the httpd server after
upgrading the packages. In order to do this, execute the following as
root:

service apache stop

(wait a few seconds and check with "ps ax|grep httpd" if there are
any httpd processes running. On a busy webserver this could take a
little longer)

service apache start


REFERENCES
1. http://httpd.apache.org/
2. http://www.idefense.com/advisory/04.08.03.txt
3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132
4. http://www.apache.org/dist/httpd/Announcement2.html
5. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=17206


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/9/SRPMS/apache-2.0.45-28790U90_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-2.0.45-28790U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-devel-2.0.45-28790U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-doc-2.0.45-28790U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-htpasswd-2.0.45-28790U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr-devel-2.0.45-28790U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr-devel-static-2.0.45-28790U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr0-2.0.45-28790U90_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

- run:                 apt-get update
- after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+sAyO42jd0JmAcZARAoRzAJ4/YiZhEH/a5PKSls5bXKbPDI0bSwCdFjWO
yLHZiBj+wWOkv+2DLxpHjHI=
=AIKW
-----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Updated:  April 09, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see GLSA 200304-01.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  April 08, 2003 Updated: September 18, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

-----------------------------------------------------------------
**REVISED 01**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0304-256
Originally issued: 25 April 2003
Last Revised:  03 Sept. 2003
SSRT3534 Potential Security Vulnerabilities in Apache HTTP Server
(rev. 1)
-----------------------------------------------------------------
NOTICE: There are no restrictions for distribution of this
Bulletin provided that it remains complete and intact.

The information in the following Security Bulletin should be
acted upon as soon as possible.  Hewlett-Packard Company will
not be liable for any consequences to any customer resulting
from customer's failure to fully implement instructions in this
Security Bulletin as soon as possible.

-----------------------------------------------------------------
PROBLEM: 1. A memory leak in Apache 2.0 through 2.0.44 potentially
allows remote attackers to cause a denial of service
(memory consumption).

More details are available at:
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132>

2. Apache httpd fails to close access and error logs when
it forks and execs cgi scripts.  This fix depends on
the APR library release 0.9.2 or later.

More details are available at:
<http://nagoya.apache.org/bugzilla/index.html>  BUG #17206

IMPACT:   Potential information leak and Denial of Service

PLATFORM: HP9000 Servers running HP-UX release 11.00, 11.11, and
11.22 with versions of the following products are
affected, and represented as:
product-name, version (product-tag/bundle-tag)

- hp apache-based web server, 2.0.43.04 or earlier
(HPApache/B9416AA, HPApache/B9416BA)
This product includes Apache 2.0.43.

- hp-ux apache-based web server, v.1.0.02.01 or earlier
(hpuxwsAPACHE/hpuxwsApache)
This product includes Apache 2.0.43.

SOLUTION: For HP-UX releases 11.00, 11.11 and 11.22 download new
HP Apache product from <http://www.software.hp.com/>:

For HPApache/B9416AA, HPApache/B9416BA and
hpuxwsAPACHE/hpuxwsApache download the following:
- hp-ux apache-based web server, v.1.0.03.01 or later
(hpuxwsAPACHE/hpuxwsApache)
This product includes Apache 2.0.45.
<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/
cgi/displayProductInfo.pl?productNumber=HPUXWSSUITE>

**REVISED 01**

--->> NOTE: The IPv6 solution is now available.  Please refer to
--->> documentation and depot's available from software.hp.com
--->> Click on "internet ready and networking"
--->> and look for "hp-ux apache-based web server
--->> v.1.0.07.01 for ipv6 powered by apache, tomcat, webmin.

MANUAL ACTIONS: Yes - Update
Install the product containing the fix.
For customers with HPApache/B9416AA or
HPApache/B9416BA installed, the fix requires
migration to hpuxwsAPACHE/hpuxwsApache and
removing the affected products from the system.

AVAILABILITY: Complete product bundles are available now on
<http://www.software.hp.com/>

** REVISED 01**
CHANGE SUMMARY:  Rev.01 Added updated IPv6 information

-----------------------------------------------------------------
A. Background
The Common Vulnerabilities and Exposures project
<http://cve.mitre.org/> has identified potential vulnerabilities
in the Apache HTTP Server (CAN-2003-0132).  These affect the
following HP product numbers/versions on HP-UX releases 11.00,
11.11 and 11.22:

- hp apache-based web server, 2.0.43.04 or earlier
(HPApache/B9416AA, HPApache/B9416BA)

- hp-ux apache-based web server, v.1.0.02.01 or earlier
(hpuxwsAPACHE/hpuxwsApache)

B. Recommended solution
The Apache Software Foundation has released Apache 2.0.45 as
the best known version that fixes the problems identified in
the above mentioned issues.

For customers using HPApache/B9416AA, HPApache/B9416BA and
hpuxwsAPACHE/hpuxwsApache, HP has incorporated Apache 2.0.45
in the following product:
- hp-ux apache-based web server v.1.0.03.01 or later
<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=HPUXWSSUITE>

**REIVSED 01**

--->> NOTE: The IPv6 solution is now available.  Please refer to
--->> documentation and depot's available from software.hp.com
--->> Click on "internet ready and networking"
--->> and look for "hp-ux apache-based web server
--->> v.1.0.07.01 for ipv6 powered by apache, tomcat, webmin.

Check for Apache Installation
-----------------------------
To determine if the Apache web server from HP is installed on
your system, use Software Distributor's swlist command.  All
three versions products may co-exist on a single system.

For example, the results of the command
swlist -l product | grep -i apache

HPApache      2.0.39.01.02  HP Apache-based Web Server
hpuxwsAPACHE  A.1.0.01.01   HP-UX Apache-based Web Server

Stop Apache
-----------------------------
Before updating, make sure to stop any previous Apache binary.
Otherwise, the previous binary will continue running,
preventing the new one from starting, although the
installation would be successful.

After determining which Apache is installed, stop Apache with
the following commands:

for HPApache:        /opt/hpapache2/bin/apachectl stop
for hpuxwsAPACHE:    /opt/hpws/apache/bin/apachectl stop

Download and Install Apache
-----------------------------
- Download Apache from Software Depot using the previously
mentioned links.
- Verify successful download by comparing the cksum with the
value specified on the installation web page.
- Use SD to swinstall the depot.
- For customers with HPApache/B9416AA or HPApache/B9416BA
installed, migrate to hpuxwsAPACHE/hpuxwsApache and
remove the affected products from the system.

Installation of this new version of HP Apache over an existing
HP Apache installation is supported, while installation over
a non-HP Apache is NOT supported.

Removing Apache Installation
----------------------------
If you rather remove Apache from your system than install a
newer version to resolve the security problem, use both
Software Distributor's "swremove" command and also "rm -rf"
the home location as specified in the rc.config.d file "HOME"
variables.

To find the files containing HOME variables in the
/etc/rc.config.d directory:

%ls /etc/rc.config.d | grep apache
hpapache2conf
hpws_apacheconf

C. To subscribe to automatically receive future NEW HP Security
Bulletins from the HP IT Resource Center via electronic
mail, do the following:

Use your browser to get to the HP IT Resource Center page
at:

<http://itrc.hp.com>

Use the 'Login' tab at the left side of the screen to login
using your ID and password.  Use your existing login or the
"Register" button at the left to create a login, in order to
gain access to many areas of the ITRC.  Remember to save the
User ID assigned to you, and your password.

In the left most frame select "Maintenance and Support".

Under the "Notifications" section (near the bottom of
the page), select "Support Information Digests".

To -subscribe- to future HP Security Bulletins or other
Technical Digests, click the check box (in the left column)
for the appropriate digest and then click the "Update
Subscriptions" button at the bottom of the page.

or

To -review- bulletins already released, select the link
(in the middle column) for the appropriate digest.

NOTE: Using your itrc account security bulletins can be
found here:
<http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin>


To -gain access- to the Security Patch Matrix, select
the link for "The Security Bulletins Archive".  (near the
bottom of the page)  Once in the archive the third link is
to the current Security Patch Matrix. Updated daily, this
matrix categorizes security patches by platform/OS release,
and by bulletin topic.  Security Patch Check completely
automates the process of reviewing the patch matrix for
11.XX systems.  Please note that installing the patches
listed in the Security Patch Matrix will completely
implement a security bulletin _only_ if the MANUAL ACTIONS
field specifies "No."

The Security Patch Check tool can verify that a security
bulletin has been implemented on HP-UX 11.XX systems providing
that the fix is completely implemented in a patch with no
manual actions required.  The Security Patch Check tool cannot
verify fixes implemented via a product upgrade.

For information on the Security Patch Check tool, see:
<http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/
displayProductInfo.pl?productNumber=B6834AA>

The security patch matrix is also available via anonymous
ftp:

ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/

On the "Support Information Digest Main" page:
click on the "HP Security Bulletin Archive".

The PGP key used to sign this bulletin is available from
several PGP Public Key servers.  The key identification
information is:

2D2A7D59
HP Security Response Team (Security Bulletin signing only)
<security-alert@hp.com>
Fingerprint =
6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59

If you have problems locating the key please write to
security-alert@hp.com.  Please note that this key is
for signing bulletins only and is not the key returned
by sending 'get key' to security-alert@hp.com.


D. To report new security vulnerabilities, send email to

security-alert@hp.com

Please encrypt any exploit information using the
security-alert PGP key, available from your local key
server, or by sending a message with a -subject- (not body)
of 'get key' (no quotes) to security-alert@hp.com.

-----------------------------------------------------------------

(c)Copyright 2003 Hewlett-Packard Company
Hewlett-Packard Company shall not be liable for technical or
editorial errors or omissions contained herein. The information
in this document is subject to change without notice.
Hewlett-Packard Company and the names of HP products referenced
herein are trademarks and/or service marks of Hewlett-Packard
Company.  Other product and company names mentioned herein may be
trademarks and/or service marks of their respective owners.

________________________________________________________________



-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBP1aBUOAfOvwtKn1ZEQJBhgCfVCie2gIk+c6b3SYTDwr5MwzlnjUAmwey
jsh4S/bDsQK3nMvlTgGhS+yr
=/3d2
-----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  April 08, 2003 Updated: September 18, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

Mandrake Linux Security Update Advisory
________________________________________________________________________

Package name:           apache2
Advisory ID:            MDKSA-2003:050
Date:                   April 22nd, 2003

Affected versions:9.1
________________________________________________________________________

Problem Description:

A memory leak was discovered in Apache 2.0 through 2.0.44 that can
allow a remote attacker to cause a significant denial of service
(DoS) by sending requests containing a lot of linefeed characters to
the server.

As well, Apache does not filter terminal escape sequences from its
log files, which could make it easy for an attacker to insert those
sequences into the error and access logs, which could possibly be
viewed by certain terminal emulators with vulnerabilities related to
escape sequences.

After upgrading these packages, be sure to restart the httpd server
by executing:

service httpd restart
________________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0083
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132
________________________________________________________________________

Updated Packages:

Mandrake Linux 9.1:
ad53df84893a5cc1114c3de55cc91658  9.1/RPMS/apache2-2.0.45-4.2mdk.i586.rpm
60d8447552d758bc3565450f08b79bfe  9.1/RPMS/apache2-common-2.0.45-4.2mdk.i586.rpm
3060613a3a072d9fffc9bbfd0a994581  9.1/RPMS/apache2-devel-2.0.45-4.2mdk.i586.rpm
36504391b61565e9607a70c2d42a3b6a  9.1/RPMS/apache2-manual-2.0.45-4.2mdk.i586.rpm
b1778fe2310da4c8c94fcdefb6856ccd  9.1/RPMS/apache2-mod_dav-2.0.45-4.2mdk.i586.rpm
f7b614162bad34d2778b8621d7878641  9.1/RPMS/apache2-mod_ldap-2.0.45-4.2mdk.i586.rpm
e8c3e2db532f8c2c94b5ef05bab0ce85  9.1/RPMS/apache2-mod_ssl-2.0.45-4.2mdk.i586.rpm
2f56e31ce758a96a1c9fd8060eba4d1a  9.1/RPMS/apache2-modules-2.0.45-4.2mdk.i586.rpm
69029f8e2bda1254c6f469df9eace7f7  9.1/RPMS/apache2-source-2.0.45-4.2mdk.i586.rpm
43999a817273e73e901f8bf8ff05389f  9.1/RPMS/libapr0-2.0.45-4.2mdk.i586.rpm
ab454d8e8e1d9c3f51a98ad2aaa4cffc  9.1/SRPMS/apache-conf-2.0.45-2.1mdk.src.rpm
c11d11afb80fba23925632089a70bc00  9.1/SRPMS/apache2-2.0.45-4.2mdk.src.rpm

Mandrake Linux 9.1/PPC:
b9db2f91c7937244acb2d32f34ae9241  ppc/9.1/RPMS/apache2-2.0.45-4.2mdk.ppc.rpm
3bc96cd24d6bd3b307222d81fce9f4ca  ppc/9.1/RPMS/apache2-common-2.0.45-4.2mdk.ppc.rpm
60e4187ec0b293f25a9008c13c527c1a  ppc/9.1/RPMS/apache2-devel-2.0.45-4.2mdk.ppc.rpm
a3c3322b834790fc1da3c8e7f0901168  ppc/9.1/RPMS/apache2-manual-2.0.45-4.2mdk.ppc.rpm
352b82414ec0362eaa9c7ea451261a60  ppc/9.1/RPMS/apache2-mod_dav-2.0.45-4.2mdk.ppc.rpm
a537dc5489a82099cb87b24f3718e11c  ppc/9.1/RPMS/apache2-mod_ldap-2.0.45-4.2mdk.ppc.rpm
e6736e2c450bc76382cceaf7116e1616  ppc/9.1/RPMS/apache2-mod_ssl-2.0.45-4.2mdk.ppc.rpm
f5b6f2d90cb73845987624c7ffd514a3  ppc/9.1/RPMS/apache2-modules-2.0.45-4.2mdk.ppc.rpm
dca30abc0adead3a22c5fd3a82df8d20  ppc/9.1/RPMS/apache2-source-2.0.45-4.2mdk.ppc.rpm
f33cdee67bd82884bd6d77c551320961  ppc/9.1/RPMS/libapr0-2.0.45-4.2mdk.ppc.rpm
ab454d8e8e1d9c3f51a98ad2aaa4cffc  ppc/9.1/SRPMS/apache-conf-2.0.45-2.1mdk.src.rpm
c11d11afb80fba23925632089a70bc00  ppc/9.1/SRPMS/apache2-2.0.45-4.2mdk.src.rpm
________________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
________________________________________________________________________

To upgrade automatically, use MandrakeUpdate.  The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".  A list of
FTP mirrors can be obtained from:

http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

rpm --checksig <filename>

All packages are signed by MandrakeSoft for security.  You can obtain
the GPG public key of the Mandrake Linux Security Team from:

https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other update advisories for Mandrake Linux at:

http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

security_linux-mandrake.com

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPaIRgQQEQIA
BgUCPI+UAwAKCRDniYrgcHcf8xK5AKCm/Mq8qP8GE0o1hEX22QsJMZwH5gCfZ72H
8TacOb3oAmBdprf+K6gkdOiIRgQQEQIABgUCOtOieAAKCRCv2bZyU0yB80MeAJ9K
+jXt0cKuaUonRU+CRGetk6t9dgCfTRRL6/puOKdD6md70+K5EBBSvsG0OE1hbmRy
YWtlIExpbnV4IFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QG1hbmRyYWtlc29mdC5j
b20+iFcEExECABcFAjyPnuUFCwcKAwQDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmFi+
AJsHhohgnU3ik4+gy3EdFlB2i/MBoACg6lHn5cnVvTcmgNccWxeNxLLZI5e5AQ0E
OWnn7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ
9F779FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzR
xBXVJb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z
269s+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN
6SCXVl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZ
jTcl3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo
0NAiRYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJ
EJGXlA==
=yGlX
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+pcY0mqjQ0CJFipgRAs4KAKCMHUCeQJqs/XlZYTXZg/kL4Pfe9ACfdbLk
+8Th2yf+xm6Gvn6OVZV+Kp4=
=S5i5
-----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Notified:  April 08, 2003 Updated: September 18, 2003

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________
SGI Security Advisory

Title    : Security Vulnerabilities in MediaBase Apache and PHP
Number   : 20030502-01-I
Date     : May 19, 2003
Reference: Kasenna Support Issue # 1095 and # 1330
Fixed in : Patches from Kasenna Support Website
______________________________________________________________________________

- -----------------------
- --- Issue Specifics ---
- -----------------------

It's been reported that Kasenna Mediabase has insecure versions of
Apache and PHP.

SGI has investigated the issue and recommends the following steps for
neutralizing the exposure.  It is HIGHLY RECOMMENDED that these measures
be implemented on ALL vulnerable SGI systems.

These issues have been corrected with patches and in future releases of
MediaBase.


- --------------
- --- Impact ---
- --------------

MediaBase is an optional product from Kasenna, and is not installed by
default on IRIX 6.5 systems.

To determine the version of IRIX you are running, execute the following
command:

# /bin/uname -R

That will return a result similar to the following:

# 6.5 6.5.16f

The first number ("6.5") is the release name, the second ("6.5.16f" in this
case) is the extended release name.  The extended release name is the
"version" we refer to throughout this document.

To see if mediabase is installed, execute the following command:

% versions -b | grep mbase
I  mbase_client         06/01/2000  WebFORCE MediaBase 2.1 - Client
I  mbase_players        10/06/2000  SGI MediaBase 4.0.1 - Players packaged
for installation on server
I  mbase_root           12/24/2000  SGI MediaBase 4.0.1 - Development ROOT
Files
I  mbase_server         10/06/2000  SGI MediaBase 4.0.1 - MediaBase Server
Execution Environment
I  mbase_server_spk1    12/24/2000  SGI MediaBase 4.0.1 - MediaBase Server
Service Pack 1

To determine if the version of Apache installed as part of MediaBase is
vulnerable, execute the following command:

% /usr/kasenna/apache/bin/httpd -v
Server version: Apache/1.3.14 (Unix)
Server built:   Dec 20 2000 15:52:52

If the version shown (in this case 1.3.14) is lower than 1.3.27, then the
system is vulnerable.


To determine if the version of PHP installed as part of MediaBase is
vulnerable, execute the following commands:

%/usr/bin/elfdump -L /usr/mbase/asset_gateway/php_apache.so | grep TIMSTAMP
[46]    TIMSTAMP    Jan 13 14:50:39 2003

%/usr/bin/elfdump -L /usr/mbase/asset_gateway/php_mediabase.so | grep TIMSTAMP
[45]    TIMSTAMP    Jan 10 14:02:48 2003

If the value shown for "TIMSTAMP" is earlier than the ones shown, then the
system is vulnerable.


- ----------------------------
- --- Temporary Workaround ---
- ----------------------------

There is no effective workaround available for these problems if MediaBase
is needed.  SGI and Kasenna recommend installing the patches shown below
from the Kasenna website.


- ----------------
- --- Solution ---
- ----------------

Kasenna MediaBase is an optional product, the system is vulnerable if
a vulnerable version of MediaBase and its associated Apache and PHP
components are installed.  Please run the commands shown in the "Impact"
section above and install the patches if those commands show
the system to be vulnerable.

Kasenna has provided patches for these vulnerabilities. Our recommendation
is to install the patches provided by Kasenna.

To obtain the Kasenna MediaBase patches, go to http://support.kasenna.com/
and install the patches shown in support issue 1095 (apache) and 1033 (PHP).


- ------------------------
- --- Acknowledgments ----
- ------------------------

SGI wishes to thank FIRST and the users of the Internet Community at large
for their assistance in this matter.


- -------------
- --- Links ---
- -------------

SGI Security Advisories can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/

SGI Security Patches can be found at:
http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/

SGI patches for IRIX can be found at the following patch servers:
http://support.sgi.com/ and ftp://patches.sgi.com/

SGI freeware updates for IRIX can be found at:
http://freeware.sgi.com/

SGI fixes for SGI open sourced code can be found on:
http://oss.sgi.com/projects/

SGI patches and RPMs for Linux can be found at:
http://support.sgi.com/

SGI patches for Windows NT or 2000 can be found at:
http://support.sgi.com/

IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
http://support.sgi.com/ and ftp://patches.sgi.com/support/patchset/

IRIX 6.5 Maintenance Release Streams can be found at:
http://support.sgi.com/

IRIX 6.5 Software Update CDs can be obtained from:
http://support.sgi.com/

The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com.  Security advisories and patches are located under the URL
ftp://patches.sgi.com/support/free/security/

For security and patch management reasons, ftp.sgi.com (mirrors
patches.sgi.com security FTP repository) lags behind and does not do a
real-time update.


- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------

If there are questions about this document, email can be sent to
security-info@sgi.com.

------oOo------

SGI provides security information and patches for use by the entire SGI
community.  This information is freely available to any person needing the
information and is available via anonymous FTP and the Web.

The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com.  Security advisories and patches are located under the URL
ftp://patches.sgi.com/support/free/security/

The SGI Security Headquarters Web page is accessible at the URL:
http://www.sgi.com/support/security/

For issues with the patches on the FTP sites, email can be sent to
security-info@sgi.com.

For assistance obtaining or working with security patches, please
contact your SGI support provider.

------oOo------

SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email) all
SGI Security Advisories when they are released. Subscribing to the mailing
list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html) or by sending email to
SGI as outlined below.

% mail wiretap-request@sgi.com
subscribe wiretap <YourEmailAddress such as aaanalyst@sgi.com >
end
^d

In the example above, <YourEmailAddress> is the email address that you wish
the mailing list information sent to.  The word end must be on a separate
line to indicate the end of the body of the message. The control-d (^d) is
used to indicate to the mail program that you are finished composing the
mail message.


------oOo------

SGI provides a comprehensive customer World Wide Web site. This site is
located at http://www.sgi.com/support/security/ .

------oOo------

If there are general security questions on SGI systems, email can be sent to
security-info@sgi.com.

For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider.  A support
contract is not required for submitting a security report.

______________________________________________________________________________
This information is provided freely to all interested parties
and may be redistributed provided that it is not altered in any
way, SGI is appropriately credited and the document retains and
includes its valid PGP signature.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBPsk2RLQ4cFApAP75AQEJ/AP/WEMo5vC7eqGVrHFnuJlozO26m6n2yNR7
qUla/iyvXonSCrL6D6ar8kKt7qnpodIq4r6wmD2x/Mapwd2xmm2DgsDCxPwjzj//
UgFJqBKEaHkL3CTo0RYSnYEwQ7xvQWBJSMx4dRYwoEnBKl1hEI3CHzcfkeNEhEhT
9xdFKv9jjHA=
=4cPh
-----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.