Debians sikkerhedsbulletin
DSA-187-1 apache -- flere sårbarheder
- Rapporteret den:
- 4. nov 2002
- Berørte pakker:
- apache
- Sårbar:
- Ja
- Referencer i sikkerhedsdatabaser:
- I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 5847, BugTraq-id 5884, BugTraq-id 5887, BugTraq-id 2182, BugTraq-id 5995.
I Mitres CVE-ordbog: CVE-2002-0839, CVE-2002-0840, CVE-2002-0843, CVE-2001-0131, CVE-2002-1233. - Yderligere oplysninger:
-
Ifølge David Wagner, iDEFENSE og Apache HTTP Server-projektet, er der fundet flere sårbarheder som kan fjernudnyttes i Apache-pakken, en udbredt webserver. Disse sårbarheder kan give en angriber mulighed for at sætte et "denial of service"-angreb mod serveren i gang, eller udføre et "cross site scripting"-angreb. Projektet "Common Vulnerabilities and Exposures" (CVE) har fundet frem til følgende sårbarheder:
- CAN-2002-0839: Der er en sårbarhed på platforme som anvender System V-scoreboards baseret på delt hukommelse. Denne sårbarhed giver en angriber mulighed for at udføre programmer under Apaches UID for at udnytte Apaches delt hukommelse-scoreboardformat og signalere til en vilkårlig anden proces som root, eller forsage et lokalt "denial of service"-angreb.
- CAN-2002-0840: Apache er modtagelig overfor en "cross site scripting"-sårbarhed i standard 404-siden på en webserver som befinder sig på et domæne, der tillader wildcard-DNS-opslag.
- CAN-2002-0843: Der var nogle mulige overløb i værktøjet ApacheBench (ab) som kunne udnyttes af en ondsindet server.
- CAN-2002-1233: En "race condition" i programmerne htpasswd og htdigest giver en ondsindet lokal bruger mulighed for at læse eller endda ændre på indholdet af adgangskodefilen, eller mulighed for let at oprette og overskrive filer som den bruger, der kører htpasswd- (eller henholdsvis htdigest-)programmet.
- CAN-2001-0131: htpasswd og htdigest i Apache 2.0a9, 1.3.14, og andre
tillader lokale brugere at overskrive vilkårlige filer via et
symlink-angreb.
Dette er den samme sårbarhed som CAN-2002-1233, der allerede er rettet i potato, men senere forsvandt og aldrig blev tilføjet af opstrøm.
- Ingen-CAN: Der er fundet flere bufferoverløb i værktøjet ApacheBench, der kunne udnyttes af en fjernserver som returnerer meget lange strenge.
Disse problemer er rettet i version 1.3.26-0woody3 i den aktuelle stabile distribution (woody) og i 1.3.9-14.3 i den gamle stabile distribution (potato). Rettede pakker til den ustabile distribution (sid) forventes snart.
Vi anbefaler at du omgående opgraderer din Apache-pakke.
- Rettet i:
-
Debian GNU/Linux 2.2 (potato)
- Kildekode:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3.diff.gz
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3.dsc
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9.orig.tar.gz
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3.dsc
- Arkitekturuafhængig komponent:
- http://security.debian.org/pool/updates/main/a/apache/apache-doc_1.3.9-14.3_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3_alpha.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_alpha.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.9-14.3_alpha.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3_arm.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_arm.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.9-14.3_arm.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3_i386.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_i386.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.9-14.3_i386.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_i386.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3_m68k.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_m68k.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.9-14.3_m68k.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_m68k.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3_powerpc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_powerpc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.9-14.3_powerpc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_powerpc.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.9-14.3_sparc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_sparc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.9-14.3_sparc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.9-14.3_sparc.deb
Debian GNU/Linux 3.0 (woody)
- Kildekode:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3.diff.gz
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3.dsc
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26.orig.tar.gz
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3.dsc
- Arkitekturuafhængig komponent:
- http://security.debian.org/pool/updates/main/a/apache/apache-doc_1.3.26-0woody3_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_alpha.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_alpha.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_alpha.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_arm.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_arm.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_arm.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_i386.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_i386.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_i386.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_ia64.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_ia64.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_ia64.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_ia64.deb
- HP Precision:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_hppa.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_hppa.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_hppa.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_m68k.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_m68k.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_m68k.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_mips.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_mips.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_mips.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_mipsel.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_mipsel.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_mipsel.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_powerpc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_powerpc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_powerpc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_s390.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_s390.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_s390.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/a/apache/apache_1.3.26-0woody3_sparc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_sparc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-dev_1.3.26-0woody3_sparc.deb
- http://security.debian.org/pool/updates/main/a/apache/apache-common_1.3.26-0woody3_sparc.deb
MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.