rhsa-2002_135
Vulnerability from csaf_redhat
Published
2002-07-24 08:37
Modified
2024-11-21 22:26
Summary
Red Hat Security Advisory: : : : Updated secureweb packages available

Notes

Topic
Updated secureweb packages are now available for Red Hat Secure Web Server 3.2 (U.S.). These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.
Details
The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Versions of mod_ssl prior to 2.8.10 are subject to a single NULL overflow that can cause arbitrary code execution. In order to exploit this vulnerability, the Apache Web server has to be configured to allow overriding of configuration settings on a per-directory basis, and untrusted local users must be able to modify a directory in which the server is configured to allow overriding. The local attacker may then become the user that Apache is running as (usually 'www' or 'nobody'). Note that regardless of this bug, local users can obtain the same privileges if the server is configured to allow them to create CGI scripts which run as the Web server user, or if PHP is enabled but not configured in "safe mode." The errata packages contain versions of mod_ssl that have been patched and are not vulnerable to this issue. Please note that you must restart the httpsd service to use the updated module. For instructions on doing this, see the bottom of the Solutions section below.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated secureweb packages are now available for Red Hat Secure Web Server\n3.2 (U.S.). These updates incorporate a fix for an incorrect bounds check in\nversions of mod_ssl up to and including version 2.8.9.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The mod_ssl module provides strong cryptography for the Apache Web\nserver via the Secure Sockets Layer (SSL) and Transport Layer Security\n(TLS) protocols.  Versions of mod_ssl prior to 2.8.10 are subject to a\nsingle NULL overflow that can cause arbitrary code execution.\n\nIn order to exploit this vulnerability, the Apache Web server has to be\nconfigured to allow overriding of configuration settings on a per-directory\nbasis, and untrusted local users must be able to modify a directory in\nwhich the server is configured to allow overriding.  The local attacker may\nthen become the user that Apache is running as (usually \u0027www\u0027 or \u0027nobody\u0027).  \n\nNote that regardless of this bug, local users can obtain the same\nprivileges if the server is configured to allow them to create CGI scripts\nwhich run as the Web server user, or if PHP is enabled but not configured\nin \"safe mode.\"\n\nThe errata packages contain versions of mod_ssl that have been patched and\nare not vulnerable to this issue.\n\nPlease note that you must restart the httpsd service to use the updated\nmodule. For instructions on doing this, see the bottom of the Solutions\nsection below.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:135",
        "url": "https://access.redhat.com/errata/RHSA-2002:135"
      },
      {
        "category": "external",
        "summary": "http://marc.theaimsgroup.com/?l=apache-modssl\u0026m=102491918531562",
        "url": "http://marc.theaimsgroup.com/?l=apache-modssl\u0026m=102491918531562"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_135.json"
      }
    ],
    "title": "Red Hat Security Advisory: : : : Updated secureweb packages available",
    "tracking": {
      "current_release_date": "2024-11-21T22:26:35+00:00",
      "generator": {
        "date": "2024-11-21T22:26:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:135",
      "initial_release_date": "2002-07-24T08:37:00+00:00",
      "revision_history": [
        {
          "date": "2002-07-24T08:37:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-07-02T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:26:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Secure Web Server 3.2",
                "product": {
                  "name": "Red Hat Secure Web Server 3.2",
                  "product_id": "Red Hat Secure Web Server 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:secure_web_server:3.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Secure Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-0653",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616786"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Secure Web Server 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0653"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616786",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616786"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0653",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0653"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0653",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0653"
        }
      ],
      "release_date": "2002-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-07-24T08:37:00+00:00",
          "details": "Some of these files are distributed in rhmask format and may only be used\nby individuals who have purchased Red Hat Linux 6.2 Professional.\n\nTo produce installable RPM files from the rhmask files, retrieve the rhmask\nfiles via ftp and type the following command:\n\nrhmask secureweb-3.2-12.i386.rpm secureweb-3.2.7-1.i386.rpm.rhmask\n\nThe original RPM is located only on your Secure Web Server CD and cannot\nbe obtained via the Internet. \n\nNote: If you do not have the original RPM located in the same directory as\nthe rhmask file, you will need to prefix the name of the RPM with the full\npath name to its location (for example, on your installation CD).\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nAfter the appropriate updates have been applied, it will be necessary to\nmanually restart the server with the following command:\n\n/sbin/service httpsd restart",
          "product_ids": [
            "Red Hat Secure Web Server 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:135"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.