3Com Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Alcatel Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Apache Software Foundation Affected

Updated:  April 08, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see http://www.apache.org/dist/httpd/Announcement2.html.

Apple Computer Inc. Affected

Notified:  April 08, 2003 Updated: April 11, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see http://lists.apple.com/mhonarc/security-announce/msg00028.html.

AT&T Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Avaya Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

BSDI Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Cisco Systems Inc. Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Computer Associates Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Conectiva Affected

Notified:  April 08, 2003 Updated: May 01, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CONECTIVA LINUX SECURITY ANNOUNCEMENT PACKAGE : apache SUMMARY : Denial of service vulnerability DATE : 2003-04-30 14:48:00 ID : CLA-2003:632 RELEVANT RELEASES : 9 DESCRIPTION Apache[1] is the most popular webserver in use today. This update fixes two security vulnerabilities: 1. Denial of service (CAN-2003-0132)[3] David Endler from iDefense reported[2] a denial of service condition that affects the apache 2.0 branch which affects all unpatched servers up to and including version 2.0.44. There is a memory leak in these apache versions which can be remotely triggered by sending large chunks of consecutive linefeed characters. Each linefeed will cause the server to allocate 80 bytes of memory. A remote attacker can keep sending these simple requests until the server's memory is exhausted. 2. File descriptor leak[5] Christian Kratzer and Bjoern A. Zeeb identified several file descriptor leaks to child processes, such as CGI scripts, which could consitute a security threat on servers that run untrusted CGI scripts. The Apache HTTP Server Project released[4] Apache version 2.0.45 to address these issues, and this is the version provided via this update. SOLUTION It is recommended that all Apache users upgrade their packages. IMPORTANT: it is necessary to manually restart the httpd server after upgrading the packages. In order to do this, execute the following as root: service apache stop (wait a few seconds and check with "ps ax|grep httpd" if there are any httpd processes running. On a busy webserver this could take a little longer) service apache start REFERENCES 1. http://httpd.apache.org/ 2. http://www.idefense.com/advisory/04.08.03.txt 3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132 4. http://www.apache.org/dist/httpd/Announcement2.html 5. http://nagoya.apache.org/bugzilla/show_bug.cgi?id=17206 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/9/SRPMS/apache-2.0.45-28790U90_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-2.0.45-28790U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-devel-2.0.45-28790U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-doc-2.0.45-28790U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/apache-htpasswd-2.0.45-28790U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr-devel-2.0.45-28790U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr-devel-static-2.0.45-28790U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libapr0-2.0.45-28790U90_1cl.i386.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en Copyright (c) 2003 Conectiva Inc. http://www.conectiva.com subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+sAyO42jd0JmAcZARAoRzAJ4/YiZhEH/a5PKSls5bXKbPDI0bSwCdFjWO yLHZiBj+wWOkv+2DLxpHjHI= =AIKW -----END PGP SIGNATURE-----

Cray Inc. Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Data General Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Debian Affected

Updated:  April 08, 2003

Status

Affected

Vendor Statement

Neither the stable nor the old stable distributions are affected by this problem. Apache 2 is only part of the unstable distribution and version 2.0.45-2 has been uploaded including the fix. Any package with a version of 2.0.45-2 or higher are fixed.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

D-Link Systems Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Engarde Not Affected

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Not Affected

Vendor Statement

We do not ship Apache 2.x in any of our products, so we are not vulnerable to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

F5 Networks Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Foundry Networks Inc. Not Affected

Notified:  April 08, 2003 Updated: April 10, 2003

Status

Not Affected

Vendor Statement

Foundry Networks is currently not shipping any products with Apache 2.x. Foundry Networks is not affected by the Apache vulnerability described in CERT VU#206537.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

FreeBSD Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Fujitsu Not Affected

Notified:  April 08, 2003 Updated: April 17, 2003

Status

Not Affected

Vendor Statement

Fujitsu's UXP/V o.s. is not affected by the problem in VU#206537 because it does not support the Apache.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Gentoo Linux Affected

Updated:  April 09, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Please see GLSA 200304-01.

Hewlett-Packard Company Affected

Notified:  April 08, 2003 Updated: September 18, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 **REVISED 01** Source: HEWLETT-PACKARD COMPANY SECURITY BULLETIN: HPSBUX0304-256 Originally issued: 25 April 2003 Last Revised: 03 Sept. 2003 SSRT3534 Potential Security Vulnerabilities in Apache HTTP Server (rev. 1) NOTICE: There are no restrictions for distribution of this Bulletin provided that it remains complete and intact. The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. PROBLEM: 1. A memory leak in Apache 2.0 through 2.0.44 potentially allows remote attackers to cause a denial of service (memory consumption). More details are available at: 2. Apache httpd fails to close access and error logs when it forks and execs cgi scripts. This fix depends on the APR library release 0.9.2 or later. More details are available at: BUG #17206 IMPACT: Potential information leak and Denial of Service PLATFORM: HP9000 Servers running HP-UX release 11.00, 11.11, and 11.22 with versions of the following products are affected, and represented as: product-name, version (product-tag/bundle-tag) - hp apache-based web server, 2.0.43.04 or earlier (HPApache/B9416AA, HPApache/B9416BA) This product includes Apache 2.0.43. - hp-ux apache-based web server, v.1.0.02.01 or earlier (hpuxwsAPACHE/hpuxwsApache) This product includes Apache 2.0.43. SOLUTION: For HP-UX releases 11.00, 11.11 and 11.22 download new HP Apache product from : For HPApache/B9416AA, HPApache/B9416BA and hpuxwsAPACHE/hpuxwsApache download the following: - hp-ux apache-based web server, v.1.0.03.01 or later (hpuxwsAPACHE/hpuxwsApache) This product includes Apache 2.0.45. **REVISED 01** --->> NOTE: The IPv6 solution is now available. Please refer to --->> documentation and depot's available from software.hp.com --->> Click on "internet ready and networking" --->> and look for "hp-ux apache-based web server --->> v.1.0.07.01 for ipv6 powered by apache, tomcat, webmin. MANUAL ACTIONS: Yes - Update Install the product containing the fix. For customers with HPApache/B9416AA or HPApache/B9416BA installed, the fix requires migration to hpuxwsAPACHE/hpuxwsApache and removing the affected products from the system. AVAILABILITY: Complete product bundles are available now on ** REVISED 01** CHANGE SUMMARY: Rev.01 Added updated IPv6 information A. Background The Common Vulnerabilities and Exposures project has identified potential vulnerabilities in the Apache HTTP Server (CAN-2003-0132). These affect the following HP product numbers/versions on HP-UX releases 11.00, 11.11 and 11.22: - hp apache-based web server, 2.0.43.04 or earlier (HPApache/B9416AA, HPApache/B9416BA) - hp-ux apache-based web server, v.1.0.02.01 or earlier (hpuxwsAPACHE/hpuxwsApache) B. Recommended solution The Apache Software Foundation has released Apache 2.0.45 as the best known version that fixes the problems identified in the above mentioned issues. For customers using HPApache/B9416AA, HPApache/B9416BA and hpuxwsAPACHE/hpuxwsApache, HP has incorporated Apache 2.0.45 in the following product: - hp-ux apache-based web server v.1.0.03.01 or later **REIVSED 01** --->> NOTE: The IPv6 solution is now available. Please refer to --->> documentation and depot's available from software.hp.com --->> Click on "internet ready and networking" --->> and look for "hp-ux apache-based web server --->> v.1.0.07.01 for ipv6 powered by apache, tomcat, webmin. Check for Apache Installation To determine if the Apache web server from HP is installed on your system, use Software Distributor's swlist command. All three versions products may co-exist on a single system. For example, the results of the command swlist -l product | grep -i apache HPApache 2.0.39.01.02 HP Apache-based Web Server hpuxwsAPACHE A.1.0.01.01 HP-UX Apache-based Web Server Stop Apache Before updating, make sure to stop any previous Apache binary. Otherwise, the previous binary will continue running, preventing the new one from starting, although the installation would be successful. After determining which Apache is installed, stop Apache with the following commands: for HPApache: /opt/hpapache2/bin/apachectl stop for hpuxwsAPACHE: /opt/hpws/apache/bin/apachectl stop Download and Install Apache - Download Apache from Software Depot using the previously mentioned links. - Verify successful download by comparing the cksum with the value specified on the installation web page. - Use SD to swinstall the depot. - For customers with HPApache/B9416AA or HPApache/B9416BA installed, migrate to hpuxwsAPACHE/hpuxwsApache and remove the affected products from the system. Installation of this new version of HP Apache over an existing HP Apache installation is supported, while installation over a non-HP Apache is NOT supported. Removing Apache Installation If you rather remove Apache from your system than install a newer version to resolve the security problem, use both Software Distributor's "swremove" command and also "rm -rf" the home location as specified in the rc.config.d file "HOME" variables. To find the files containing HOME variables in the /etc/rc.config.d directory: %ls /etc/rc.config.d | grep apache hpapache2conf hpws_apacheconf C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP IT Resource Center via electronic mail, do the following: Use your browser to get to the HP IT Resource Center page at: Use the 'Login' tab at the left side of the screen to login using your ID and password. Use your existing login or the "Register" button at the left to create a login, in order to gain access to many areas of the ITRC. Remember to save the User ID assigned to you, and your password. In the left most frame select "Maintenance and Support". Under the "Notifications" section (near the bottom of the page), select "Support Information Digests". To -subscribe- to future HP Security Bulletins or other Technical Digests, click the check box (in the left column) for the appropriate digest and then click the "Update Subscriptions" button at the bottom of the page. or To -review- bulletins already released, select the link (in the middle column) for the appropriate digest. NOTE: Using your itrc account security bulletins can be found here: To -gain access- to the Security Patch Matrix, select the link for "The Security Bulletins Archive". (near the bottom of the page) Once in the archive the third link is to the current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. Security Patch Check completely automates the process of reviewing the patch matrix for 11.XX systems. Please note that installing the patches listed in the Security Patch Matrix will completely implement a security bulletin _only_ if the MANUAL ACTIONS field specifies "No." The Security Patch Check tool can verify that a security bulletin has been implemented on HP-UX 11.XX systems providing that the fix is completely implemented in a patch with no manual actions required. The Security Patch Check tool cannot verify fixes implemented via a product upgrade. For information on the Security Patch Check tool, see: The security patch matrix is also available via anonymous ftp: ftp://ftp.itrc.hp.com/export/patches/hp-ux_patch_matrix/ On the "Support Information Digest Main" page: click on the "HP Security Bulletin Archive". The PGP key used to sign this bulletin is available from several PGP Public Key servers. The key identification information is: 2D2A7D59 HP Security Response Team (Security Bulletin signing only) Fingerprint = 6002 6019 BFC1 BC62 F079 862E E01F 3AFC 2D2A 7D59 If you have problems locating the key please write to security-alert@hp.com. Please note that this key is for signing bulletins only and is not the key returned by sending 'get key' to security-alert@hp.com. D. To report new security vulnerabilities, send email to security-alert@hp.com Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of 'get key' (no quotes) to security-alert@hp.com. (c) Copyright 2003 Hewlett-Packard Company Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of HP products referenced herein are trademarks and/or service marks of Hewlett-Packard Company. Other product and company names mentioned herein may be trademarks and/or service marks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBP1aBUOAfOvwtKn1ZEQJBhgCfVCie2gIk+c6b3SYTDwr5MwzlnjUAmwey jsh4S/bDsQK3nMvlTgGhS+yr =/3d2 -----END PGP SIGNATURE-----

Hitachi Not Affected

Notified:  April 08, 2003 Updated: April 14, 2003

Status

Not Affected

Vendor Statement

Hitachi Web Server is NOT vulnerable, because it is not based on Apache 2.x.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

IBM Not Affected

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Not Affected

Vendor Statement

The AIX operating system does not ship with the Apache web server. The AIX operating system is not vulnerable to the issues discussed in CERT vulnerability note VU#206537. The AIX Toolbox For Linux does not ship with a vulnerable version of the Apache web server. Please note that the AIX Toolbox for Linux is shipped "as is" and is unwarranted.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Ingrian Networks Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Intel Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Juniper Networks Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Lachman Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Lotus Software Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Lucent Technologies Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

MandrakeSoft Affected

Notified:  April 08, 2003 Updated: September 18, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandrake Linux Security Update Advisory Package name: apache2 Advisory ID: MDKSA-2003:050 Date: April 22nd, 2003 Affected versions: 9.1 Problem Description: A memory leak was discovered in Apache 2.0 through 2.0.44 that can allow a remote attacker to cause a significant denial of service (DoS) by sending requests containing a lot of linefeed characters to the server. As well, Apache does not filter terminal escape sequences from its log files, which could make it easy for an attacker to insert those sequences into the error and access logs, which could possibly be viewed by certain terminal emulators with vulnerabilities related to escape sequences. After upgrading these packages, be sure to restart the httpd server by executing: service httpd restart References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0020 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0083 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0132 Updated Packages: Mandrake Linux 9.1: ad53df84893a5cc1114c3de55cc91658 9.1/RPMS/apache2-2.0.45-4.2mdk.i586.rpm 60d8447552d758bc3565450f08b79bfe 9.1/RPMS/apache2-common-2.0.45-4.2mdk.i586.rpm 3060613a3a072d9fffc9bbfd0a994581 9.1/RPMS/apache2-devel-2.0.45-4.2mdk.i586.rpm 36504391b61565e9607a70c2d42a3b6a 9.1/RPMS/apache2-manual-2.0.45-4.2mdk.i586.rpm b1778fe2310da4c8c94fcdefb6856ccd 9.1/RPMS/apache2-mod_dav-2.0.45-4.2mdk.i586.rpm f7b614162bad34d2778b8621d7878641 9.1/RPMS/apache2-mod_ldap-2.0.45-4.2mdk.i586.rpm e8c3e2db532f8c2c94b5ef05bab0ce85 9.1/RPMS/apache2-mod_ssl-2.0.45-4.2mdk.i586.rpm 2f56e31ce758a96a1c9fd8060eba4d1a 9.1/RPMS/apache2-modules-2.0.45-4.2mdk.i586.rpm 69029f8e2bda1254c6f469df9eace7f7 9.1/RPMS/apache2-source-2.0.45-4.2mdk.i586.rpm 43999a817273e73e901f8bf8ff05389f 9.1/RPMS/libapr0-2.0.45-4.2mdk.i586.rpm ab454d8e8e1d9c3f51a98ad2aaa4cffc 9.1/SRPMS/apache-conf-2.0.45-2.1mdk.src.rpm c11d11afb80fba23925632089a70bc00 9.1/SRPMS/apache2-2.0.45-4.2mdk.src.rpm Mandrake Linux 9.1/PPC: b9db2f91c7937244acb2d32f34ae9241 ppc/9.1/RPMS/apache2-2.0.45-4.2mdk.ppc.rpm 3bc96cd24d6bd3b307222d81fce9f4ca ppc/9.1/RPMS/apache2-common-2.0.45-4.2mdk.ppc.rpm 60e4187ec0b293f25a9008c13c527c1a ppc/9.1/RPMS/apache2-devel-2.0.45-4.2mdk.ppc.rpm a3c3322b834790fc1da3c8e7f0901168 ppc/9.1/RPMS/apache2-manual-2.0.45-4.2mdk.ppc.rpm 352b82414ec0362eaa9c7ea451261a60 ppc/9.1/RPMS/apache2-mod_dav-2.0.45-4.2mdk.ppc.rpm a537dc5489a82099cb87b24f3718e11c ppc/9.1/RPMS/apache2-mod_ldap-2.0.45-4.2mdk.ppc.rpm e6736e2c450bc76382cceaf7116e1616 ppc/9.1/RPMS/apache2-mod_ssl-2.0.45-4.2mdk.ppc.rpm f5b6f2d90cb73845987624c7ffd514a3 ppc/9.1/RPMS/apache2-modules-2.0.45-4.2mdk.ppc.rpm dca30abc0adead3a22c5fd3a82df8d20 ppc/9.1/RPMS/apache2-source-2.0.45-4.2mdk.ppc.rpm f33cdee67bd82884bd6d77c551320961 ppc/9.1/RPMS/libapr0-2.0.45-4.2mdk.ppc.rpm ab454d8e8e1d9c3f51a98ad2aaa4cffc ppc/9.1/SRPMS/apache-conf-2.0.45-2.1mdk.src.rpm c11d11afb80fba23925632089a70bc00 ppc/9.1/SRPMS/apache2-2.0.45-4.2mdk.src.rpm Bug IDs fixed (see https://qa.mandrakesoft.com for more information): To upgrade automatically, use MandrakeUpdate. The verification of md5 checksums and GPG signatures is performed automatically for you. If you want to upgrade manually, download the updated package from one of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command: rpm --checksig All packages are signed by MandrakeSoft for security. You can obtain the GPG public key of the Mandrake Linux Security Team from: https://www.mandrakesecure.net/RPM-GPG-KEYS Please be aware that sometimes it takes the mirrors a few hours to update. You can view other update advisories for Mandrake Linux at: http://www.mandrakesecure.net/en/advisories/ MandrakeSoft has several security-related mailing list services that anyone can subscribe to. Information on these lists can be obtained by visiting: http://www.mandrakesecure.net/en/mlist.php If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.7 (GNU/Linux) mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7 WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg 2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy /NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPaIRgQQEQIA BgUCPI+UAwAKCRDniYrgcHcf8xK5AKCm/Mq8qP8GE0o1hEX22QsJMZwH5gCfZ72H 8TacOb3oAmBdprf+K6gkdOiIRgQQEQIABgUCOtOieAAKCRCv2bZyU0yB80MeAJ9K +jXt0cKuaUonRU+CRGetk6t9dgCfTRRL6/puOKdD6md70+K5EBBSvsG0OE1hbmRy YWtlIExpbnV4IFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QG1hbmRyYWtlc29mdC5j b20+iFcEExECABcFAjyPnuUFCwcKAwQDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmFi+ AJsHhohgnU3ik4+gy3EdFlB2i/MBoACg6lHn5cnVvTcmgNccWxeNxLLZI5e5AQ0E OWnn7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ 9F779FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzR xBXVJb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z 269s+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN 6SCXVl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZ jTcl3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo 0NAiRYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJ EJGXlA== =yGlX - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+pcY0mqjQ0CJFipgRAs4KAKCMHUCeQJqs/XlZYTXZg/kL4Pfe9ACfdbLk +8Th2yf+xm6Gvn6OVZV+Kp4= =S5i5 -----END PGP SIGNATURE-----

Microsoft Corporation Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

MontaVista Software Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Multinet Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Multi-Tech Systems Inc. Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NEC Corporation Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NetBSD Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NetScreen Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Network Appliance Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

NeXT Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Nokia Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Nortel Networks Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

OpenBSD Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Openwall GNU/*/Linux Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Oracle Corporation Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Red Hat Inc. Affected

Notified:  April 08, 2003 Updated: April 10, 2003

Status

Affected

Vendor Statement

Red Hat Linux 8.0 and Red Hat Linux 9 ship with a httpd package that includes Apache 2 and are therefore vulnerable to this issue. Updated httpd packages are available along with our advisory at the URL below. Users of the Red Hat Network can update their systems using the 'up2date' tool. http://rhn.redhat.com/errata/RHSA-2003-139.html

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Riverstone Networks Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SCO Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Sequent Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SGI Affected

Notified:  April 08, 2003 Updated: September 18, 2003

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title : Security Vulnerabilities in MediaBase Apache and PHP Number : 20030502-01-I Date : May 19, 2003 Reference: Kasenna Support Issue # 1095 and # 1330 Fixed in : Patches from Kasenna Support Website - --- Issue Specifics --- It's been reported that Kasenna Mediabase has insecure versions of Apache and PHP. SGI has investigated the issue and recommends the following steps for neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be implemented on ALL vulnerable SGI systems. These issues have been corrected with patches and in future releases of MediaBase. - --- Impact --- MediaBase is an optional product from Kasenna, and is not installed by default on IRIX 6.5 systems. To determine the version of IRIX you are running, execute the following command: # /bin/uname -R That will return a result similar to the following: # 6.5 6.5.16f The first number ("6.5") is the release name, the second ("6.5.16f" in this case) is the extended release name. The extended release name is the "version" we refer to throughout this document. To see if mediabase is installed, execute the following command: % versions -b | grep mbase I mbase_client 06/01/2000 WebFORCE MediaBase 2.1 - Client I mbase_players 10/06/2000 SGI MediaBase 4.0.1 - Players packaged for installation on server I mbase_root 12/24/2000 SGI MediaBase 4.0.1 - Development ROOT Files I mbase_server 10/06/2000 SGI MediaBase 4.0.1 - MediaBase Server Execution Environment I mbase_server_spk1 12/24/2000 SGI MediaBase 4.0.1 - MediaBase Server Service Pack 1 To determine if the version of Apache installed as part of MediaBase is vulnerable, execute the following command: % /usr/kasenna/apache/bin/httpd -v Server version: Apache/1.3.14 (Unix) Server built: Dec 20 2000 15:52:52 If the version shown (in this case 1.3.14) is lower than 1.3.27, then the system is vulnerable. To determine if the version of PHP installed as part of MediaBase is vulnerable, execute the following commands: %/usr/bin/elfdump -L /usr/mbase/asset_gateway/php_apache.so | grep TIMSTAMP [46] TIMSTAMP Jan 13 14:50:39 2003 %/usr/bin/elfdump -L /usr/mbase/asset_gateway/php_mediabase.so | grep TIMSTAMP [45] TIMSTAMP Jan 10 14:02:48 2003 If the value shown for "TIMSTAMP" is earlier than the ones shown, then the system is vulnerable. - --- Temporary Workaround --- There is no effective workaround available for these problems if MediaBase is needed. SGI and Kasenna recommend installing the patches shown below from the Kasenna website. - --- Solution --- Kasenna MediaBase is an optional product, the system is vulnerable if a vulnerable version of MediaBase and its associated Apache and PHP components are installed. Please run the commands shown in the "Impact" section above and install the patches if those commands show the system to be vulnerable. Kasenna has provided patches for these vulnerabilities. Our recommendation is to install the patches provided by Kasenna. To obtain the Kasenna MediaBase patches, go to http://support.kasenna.com/ and install the patches shown in support issue 1095 (apache) and 1033 (PHP). - --- Acknowledgments ---- SGI wishes to thank FIRST and the users of the Internet Community at large for their assistance in this matter. - --- Links --- SGI Security Advisories can be found at: http://www.sgi.com/support/security/ and ftp://patches.sgi.com/support/free/security/advisories/ SGI Security Patches can be found at: http://www.sgi.com/support/security/ and ftp://patches.sgi.com/support/free/security/patches/ SGI patches for IRIX can be found at the following patch servers: http://support.sgi.com/ and ftp://patches.sgi.com/ SGI freeware updates for IRIX can be found at: http://freeware.sgi.com/ SGI fixes for SGI open sourced code can be found on: http://oss.sgi.com/projects/ SGI patches and RPMs for Linux can be found at: http://support.sgi.com/ SGI patches for Windows NT or 2000 can be found at: http://support.sgi.com/ IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at: http://support.sgi.com/ and ftp://patches.sgi.com/support/patchset/ IRIX 6.5 Maintenance Release Streams can be found at: http://support.sgi.com/ IRIX 6.5 Software Update CDs can be obtained from: http://support.sgi.com/ The primary SGI anonymous FTP site for security advisories and patches is patches.sgi.com. Security advisories and patches are located under the URL ftp://patches.sgi.com/support/free/security/ For security and patch management reasons, ftp.sgi.com (mirrors patches.sgi.com security FTP repository) lags behind and does not do a real-time update. - --- SGI Security Information/Contacts --- If there are questions about this document, email can be sent to security-info@sgi.com. ------oOo------ SGI provides security information and patches for use by the entire SGI community. This information is freely available to any person needing the information and is available via anonymous FTP and the Web. The primary SGI anonymous FTP site for security advisories and patches is patches.sgi.com. Security advisories and patches are located under the URL ftp://patches.sgi.com/support/free/security/ The SGI Security Headquarters Web page is accessible at the URL: http://www.sgi.com/support/security/ For issues with the patches on the FTP sites, email can be sent to security-info@sgi.com. For assistance obtaining or working with security patches, please contact your SGI support provider. ------oOo------ SGI provides a free security mailing list service called wiretap and encourages interested parties to self-subscribe to receive (via email) all SGI Security Advisories when they are released. Subscribing to the mailing list can be done via the Web (http://www.sgi.com/support/security/wiretap.html) or by sending email to SGI as outlined below. % mail wiretap-request@sgi.com subscribe wiretap end ^d In the example above, is the email address that you wish the mailing list information sent to. The word end must be on a separate line to indicate the end of the body of the message. The control-d (^d) is used to indicate to the mail program that you are finished composing the mail message. ------oOo------ SGI provides a comprehensive customer World Wide Web site. This site is located at http://www.sgi.com/support/security/ . ------oOo------ If there are general security questions on SGI systems, email can be sent to security-info@sgi.com. For reporting *NEW* SGI security issues, email can be sent to security-alert@sgi.com or contact your SGI support provider. A support contract is not required for submitting a security report. This information is provided freely to all interested parties and may be redistributed provided that it is not altered in any way, SGI is appropriately credited and the document retains and includes its valid PGP signature. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBPsk2RLQ4cFApAP75AQEJ/AP/WEMo5vC7eqGVrHFnuJlozO26m6n2yNR7 qUla/iyvXonSCrL6D6ar8kKt7qnpodIq4r6wmD2x/Mapwd2xmm2DgsDCxPwjzj// UgFJqBKEaHkL3CTo0RYSnYEwQ7xvQWBJSMx4dRYwoEnBKl1hEI3CHzcfkeNEhEhT 9xdFKv9jjHA= =4cPh -----END PGP SIGNATURE-----

Sony Corporation Unknown

Notified:  April 08, 2003 Updated: July 24, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Sun Microsystems Inc. Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

SuSE Inc. Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Unisys Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Wind River Systems Inc. Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Wirex Unknown

Notified:  April 08, 2003 Updated: April 08, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Wirex Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

Xerox Corporation Not Affected

Notified:  April 08, 2003 Updated: May 30, 2003

Status

Not Affected

Vendor Statement

A response to this vulnerability is available from our web site: http://www.xerox.com/security.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

zyXEL Unknown

Notified:  April 08, 2003 Updated: April 09, 2003

Status

Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

View all 58 vendors View less vendors