LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: August 29th, 2014
Linux Security Week: August 25th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Ubuntu: mod_python vulnerability Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Ubuntu Miles Egan discovered that mod_python, when used in output filter mode, did not handle output larger than 16384 bytes, and would display freed memory, possibly disclosing private data. Thanks to Jim Garrison of the Software Freedom Law Center for identifying the original bug as a security vulnerability.
=========================================================== 
Ubuntu Security Notice USN-430-1             March 06, 2007
libapache2-mod-python vulnerability
CVE-2004-2680
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  libapache2-mod-python                    3.1.3-3ubuntu1.1

Ubuntu 6.06 LTS:
  libapache2-mod-python                    3.1.4-0ubuntu1.1

After a standard system upgrade you need to restart Apache to effect the 
necessary changes.

Details follow:

Miles Egan discovered that mod_python, when used in output filter mode, 
did not handle output larger than 16384 bytes, and would display freed 
memory, possibly disclosing private data.  Thanks to Jim Garrison of the 
Software Freedom Law Center for identifying the original bug as a 
security vulnerability.


Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.3-3ubuntu1.1.diff.gz
      Size/MD5:    42855 1529fea7b05b869a360b6bc68d52386e
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.3-3ubuntu1.1.dsc
      Size/MD5:      810 63072c8e787515557969a57119e5d4c5
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.3.orig.tar.gz
      Size/MD5:   293548 2e1983e35edd428f308b0dfeb1c23bfe

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python-doc_3.1.3-3ubuntu1.1_all.deb
      Size/MD5:   101052 02819855dfc2346b9582b8687b7ce3f3
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.3-3ubuntu1.1_all.deb
      Size/MD5:    12890 29d8f3ad95844a81ef2bac9921be4ea2

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-python/libapache2-mod-python2.3_3.1.3-3ubuntu1.1_amd64.deb
      Size/MD5:    88482 bbbc44abd50a165ae5df51d97c8b59f4
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.3-3ubuntu1.1_amd64.deb
      Size/MD5:    88506 33430412a637252533673023a0eb556e

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-python/libapache2-mod-python2.3_3.1.3-3ubuntu1.1_i386.deb
      Size/MD5:    80692 43cf25dacf95697200b50280ff4b1c74
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.3-3ubuntu1.1_i386.deb
      Size/MD5:    80722 7003abb20896ed3d218febd92ad176c2

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-python/libapache2-mod-python2.3_3.1.3-3ubuntu1.1_powerpc.deb
      Size/MD5:    85980 75be899b0568d8a332ac04ae820d955e
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.3-3ubuntu1.1_powerpc.deb
      Size/MD5:    86010 f706350855b692417a9d32f2c1962abd

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-python/libapache2-mod-python2.3_3.1.3-3ubuntu1.1_sparc.deb
      Size/MD5:    82038 0b8d6e081d3e6506139a9fac4674d8ad
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.3-3ubuntu1.1_sparc.deb
      Size/MD5:    82078 71b5c528867eb166cd140a564d3fde0b

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.4-0ubuntu1.1.diff.gz
      Size/MD5:    25348 f53b1e046220df8e1cdcf4cd602ac563
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.4-0ubuntu1.1.dsc
      Size/MD5:      769 41f6be106885d14e487317c57cc8e940
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.4.orig.tar.gz
      Size/MD5:   308510 607175958137b06bcda91110414c82a1

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python-doc_3.1.4-0ubuntu1.1_all.deb
      Size/MD5:   113106 0b66fc0e0a15cbc6a57df85100e3ca62
    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python_3.1.4-0ubuntu1.1_all.deb
      Size/MD5:    13076 5488f0a55a436648c587e9a300d63881

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.4-0ubuntu1.1_amd64.deb
      Size/MD5:    88678 8542060889c4b3c32a6937070911bf33

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.4-0ubuntu1.1_i386.deb
      Size/MD5:    80676 13f3b9e1d7260ad8c34f7597954ed315

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.4-0ubuntu1.1_powerpc.deb
      Size/MD5:    85840 684789cb3c7acbeed9064200554d8da4

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python/libapache2-mod-python2.4_3.1.4-0ubuntu1.1_sparc.deb
      Size/MD5:    82000 297ab56501345f12ee9c6c0951287980


 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
How Cops and Hackers Could Abuse California’s New Phone Kill-Switch Law
Why Russian hackers are beating us
DQ Breach? HQ Says No, But Would it Know?
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.