Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

[TURBOLINUX SECURITY INFO] 18/Nov/2004
From: Turbolinux <security-announce () turbolinux co jp>
Date: Thu, 18 Nov 2004 21:22:28 +0900

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is an announcement only email list for the x86 architecture.
============================================================
Turbolinux Security Announcement 18/Nov/2004
============================================================

The following page contains the security information of Turbolinux Inc.

 - Turbolinux Security Center
   http://www.turbolinux.com/security/

 (1) apache -> Multiple vulnerabilities exist in Apache

===========================================================
* apache -> Multiple vulnerabilities exist in Apache
===========================================================

 More information :
    Apache is a powerful, full-featured, efficient, and freely-available
    Web server.

    - A buffer overflow vulnerability has been found in Apache's mod_proxy
      module exploitable via malformed Content-Length headers.

    - A buffer overflow vulnerability has been found in Apache's mod_include
      module -- in its get_tag() function.

 Impact :
    The mod_proxy vulnerability may allow an attacker to cause a denial of
    service of httpd.

    A local user could exploit the mod_include vulnerability to gain apache
    user privileges.

 Affected Products :
    - Turbolinux Appliance Server 1.0 Hosting Edition
    - Turbolinux Appliance Server 1.0 Workgroup Edition
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server
    - Turbolinux 7 Workstation

 Solution :
    Please use the turbopkg (zabom) tool to apply the necessary updates.
 ---------------------------------------------
 # turbopkg
 or
 # zabom update apache apache-devel apache-manual mod_ssl
 ---------------------------------------------


 <Turbolinux Appliance Server 1.0 Hosting Edition>

   Source Packages
   Size : MD5

   apache-1.3.27-26.src.rpm
      3107759 dca2cbcbcde45ff80d9a611da567a323

   Binary Packages
   Size : MD5

   apache-1.3.27-26.i586.rpm
       501255 c01a92b78bdb6304d42af3c520ac565c
   apache-devel-1.3.27-26.i586.rpm
        94281 2393aa5cdc3e5bf56212583470433530
   mod_ssl-2.8.14-26.i586.rpm
       181280 c679e28a0062cbff7460244ff51fd239

 <Turbolinux Appliance Server 1.0 Workgroup Edition>

   Source Packages
   Size : MD5

   apache-1.3.27-26.src.rpm
      3107759 43506d1d374a0505ea9c65916a6fd177

   Binary Packages
   Size : MD5

   apache-1.3.27-26.i586.rpm
       501454 2732c823c39c95a2a15043b40c8902a6
   apache-devel-1.3.27-26.i586.rpm
        94428 ac1dfc6beab6ab504d22f3b95dc595a0
   mod_ssl-2.8.14-26.i586.rpm
       181440 a3b4a8d050d92fda633570759f3b2353

 <Turbolinux 8 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/apache-1.3.27-26.src.rpm
      3107759 fd508c9f43f4134fdeded2d30a6c0e5e

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-1.3.27-26.i586.rpm
       501420 849a894023c4a1cf8c926d22689a7c5d
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
        94414 16e16de1872458241e27bca670041ba2
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
       850317 0a66500f4a483d8464f582c3eb7b8548
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
       181339 343ca76f7bab970a1eafdf4398e12b19

 <Turbolinux 8 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/SRPMS/apache-1.3.27-26.src.rpm
      3107759 7ac11746242fc78fc9ad947485f0287a

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-1.3.27-26.i586.rpm
       501457 2f1382d3830c2f6eb5d21134b543432a
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
        94438 47fb045028f3cea6c3caf48d8a6f8e28
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
       850603 24d104b2bdf1f16c086437cd2d658236
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/8/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
       181484 addb510be59954f4409b91d68a7a83ed

 <Turbolinux 7 Server>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/apache-1.3.27-26.src.rpm
      3107759 c80c339996c32883d422131571e78c69

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-1.3.27-26.i586.rpm
       488342 1fbc2d00ce603a467fd50571ba25a955
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
        94568 357bf535d26753f92e230b4fdabff5f2
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
       850473 874d0be136ee68e1be68095763b4c061
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
       179136 155a112ff31f5ccdd0df45f1754dad8b

 <Turbolinux 7 Workstation>

   Source Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/SRPMS/apache-1.3.27-26.src.rpm
      3107759 989fb815769836ff9a8608bafb825fa1

   Binary Packages
   Size : MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-1.3.27-26.i586.rpm
       488502 e8230258d2166b85c90e1b730ce9464c
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-devel-1.3.27-26.i586.rpm
        94591 46d98d78565671e55b3430de3e2be286
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/apache-manual-1.3.27-26.i586.rpm
       850609 69c918c305aeef366624df51841d5546
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/7/updates/RPMS/mod_ssl-2.8.14-26.i586.rpm
       179072 05ea943efebee1781dbabb1de2b2af26


 Notice :
    After performing the update, it is necessary to restart the httpd daemon.
    To do this, run the following command as user root.
 ---------------------------------------------
 # /etc/init.d/httpd restart
 or
 # /etc/rc.d/init.d/httpd restart
 ---------------------------------------------

 References:

 CVE
   [CAN-2004-0492]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492
   [CAN-2004-0940]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0940


 * You may need to update the turbopkg tool before applying the update.
Please refer to the following URL for detailed information.

  http://www.turbolinux.com/download/zabom.html
  http://www.turbolinux.com/download/zabomupdate.html

Package Update Path
http://www.turbolinux.com/update

============================================================
 * To obtain the public key

Here is the public key

 http://www.turbolinux.com/security/

 * To unsubscribe from the list

If you ever want to remove yourself from this mailing list,
  you can send a message to <server-users-e-ctl () turbolinux co jp> with
the word `unsubscribe' in the body (don't include the quotes).

unsubscribe

 * To change your email address

If you ever want to chage email address in this mailing list,
  you can send a message to <server-users-e-ctl () turbolinux co jp> with
the following command in the message body:

  chaddr 'old address' 'new address'

If you have any questions or problems, please contact
<supp_info () turbolinux co jp>

Thank you!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQFBnJQJK0LzjOqIJMwRAhZTAKCo0/O8tB5JzxrIbJ6+HpOGz2MIWwCdGqpk
VnG9l5pRI3AZymJcCg2rK4k=
=Bv9g
-----END PGP SIGNATURE-----



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • [TURBOLINUX SECURITY INFO] 18/Nov/2004 Turbolinux (Nov 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]