LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 27th, 2014
Linux Advisory Watch: October 24th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Debian: New mod_ssl packages fix acl restriction bypass Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Debian Updated package.
- --------------------------------------------------------------------------
Debian Security Advisory DSA 807-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
September 12th, 2005                    http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : libapache-mod-ssl
Vulnerability  : acl restriction bypass
Problem type   : remote
Debian-specific: no
CVE ID         : CAN-2005-2700
CERT advisory  : VU#744929
BugTraq ID     : 14721

A problem has been discovered in mod_ssl, which provides strong
cryptography (HTTPS support) for Apache that allows remote attackers
to bypass access restrictions.

For the old stable distribution (woody) this problem has been fixed in
version 2.8.9-2.5.

For the stable distribution (sarge) this problem has been fixed in
version 2.8.22-1sarge1.

For the unstable distribution (sid) this problem has been fixed in
version 2.8.24-1.

We recommend that you upgrade your libapache-mod-ssl package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5.dsc
      Size/MD5 checksum:      678 42c9d0a0f14e44ba466f2bf07aa91a2f
    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5.diff.gz
      Size/MD5 checksum:    18176 ae891738b92b0ba9f59723818f994240
    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9.orig.tar.gz
      Size/MD5 checksum:   752613 aad438a4eaeeee29ae74483f7afe9db0

  Architecture independent components:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl-doc_2.8.9-2.5_all.deb
      Size/MD5 checksum:   288148 c1ac22c913e960e5b3e62360d3486aa3

  Alpha architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_alpha.deb
      Size/MD5 checksum:   248124 e011a4adbdf97b724ab8a8162217c9a9

  ARM architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_arm.deb
      Size/MD5 checksum:   240264 bf3f0f685d7d207a17d39e2181ba989e

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_i386.deb
      Size/MD5 checksum:   239404 eca68ce8bf3e2247e0279c1b3628e60c

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_ia64.deb
      Size/MD5 checksum:   268944 1ede24bd30b8ea77e0fce6a49010033e

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_hppa.deb
      Size/MD5 checksum:   248308 a56a68fb2b0a7ab063602e8c8f3f2538

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_m68k.deb
      Size/MD5 checksum:   241318 2fbeb081aef69c28e5f8fc2ecd7db836

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_mips.deb
      Size/MD5 checksum:   236352 fbd352506975b03aef5f6e4086774709

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_mipsel.deb
      Size/MD5 checksum:   236222 e9961d0c726dda2043871299fa025c06

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_powerpc.deb
      Size/MD5 checksum:   242200 3bc5c820ed9d3b1809d155849503ef62

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_s390.deb
      Size/MD5 checksum:   242268 7904cf59c3721ea30e81ef459779ff61

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.9-2.5_sparc.deb
      Size/MD5 checksum:   244344 482824082ae26b56d7c11a1097594c10


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1.dsc
      Size/MD5 checksum:      777 aec67b282ab592d34db203410ef5cde6
    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1.diff.gz
      Size/MD5 checksum:    30142 52ac6a109d51bd1f62f7cb7377a60d7f
    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22.orig.tar.gz
      Size/MD5 checksum:   754606 cdfdf1f576f77768c90825b43b462405

  Architecture independent components:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl-doc_2.8.22-1sarge1_all.deb
      Size/MD5 checksum:   253078 b3928bc80d9fcbf60a3d0d464be33d4c

  Alpha architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_alpha.deb
      Size/MD5 checksum:   273382 94b20d48635978fc3d3dd5cc793070dc

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_amd64.deb
      Size/MD5 checksum:   269692 7fa6da362ad89889e76573298849e1f8

  ARM architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_arm.deb
      Size/MD5 checksum:   262890 1f7a033007f8b439723f7f7efbb3b03b

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_i386.deb
      Size/MD5 checksum:   265342 ba6d68db82b12e75ff84e0de13bb665a

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_ia64.deb
      Size/MD5 checksum:   291062 bb299b74a00d4997f3c44680cce1e5a5

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_hppa.deb
      Size/MD5 checksum:   275966 9a9cb9625e8d5f65026a7fb52ce50a18

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_m68k.deb
      Size/MD5 checksum:   267556 ddfdc0675713fc0a00787a6e9781e8e4

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_mips.deb
      Size/MD5 checksum:   262734 faa260d56b0dea69c27095c062c04ade

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_mipsel.deb
      Size/MD5 checksum:   262600 3fbc806ed03c1276f7c210258623beac

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_powerpc.deb
      Size/MD5 checksum:   266024 3bae19ace2cd7023bbe5c6d73bf7adcb

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_s390.deb
      Size/MD5 checksum:   273948 a18d42e87496c31df94b35f2053e729e

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/libapache-mod-ssl_2.8.22-1sarge1_sparc.deb
      Size/MD5 checksum:   267428 b54b9bba8902ba95470baa6f32738570


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Pirate Bay founder guilty in historic hacker case
Parallels CTO: Linux container security is not the problem
Advisory says to assume all Drupal 7 websites are compromised
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.