rhsa-2002_243
Vulnerability from csaf_redhat
Published
2002-11-08 11:15
Modified
2024-11-21 22:31
Summary
Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold

Notes

Topic
Updated versions of the Apache HTTP server, PHP, and mod_ssl are now available which close possible buffer overflows in the Apache HTTP server benchmarking tool, fixes two cross-site scripting vulnerabilities in the error pages, and fix possible local privilege escalation. These updates also fix vulnerabilities in the PHP mail() function that allows script authors to bypass safe mode restrictions, and possibly allow remote attackers to insert arbitrary mail headers and content into messages.
Details
The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP server. Buffer overflows in the ApacheBench support program (ab.c) in Apache versions prior to 1.3.27, allow a malicious Web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0843 to this issue. Two cross-site scripting vulnerabilities are present in the error pages for the default "404 Not Found" error, and for the error response when a plain HTTP request is received on an SSL port. Both of these issues are only exploitable if the "UseCanonicalName" setting has been changed to "Off", and wildcard DNS is in use, and would allow remote attackers to execute scripts as other Web page visitors, for instance, to steal cookies. These issues affect Apache versions 1.3 to 1.3.26, and mod_ssl versions before 2.8.12. The Common Vulnerabilities and Exposures project has assigned the names CAN-2002-0840 and CAN-2002-1157 to these issues. The shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to version 1.3.27, allowed a user running as the web server user to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or other such behavior that would not normally be allowed. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-839 to this issue. The mail function in PHP 4.x to 4.2.2 may allow local script authors to bypass safe mode restrictions and modify command line arguments to the MTA (such as Sendmail) in the fifth argument to mail(), altering MTA behavior and possibly executing arbitrary local commands. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0985 to this issue. The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy". The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0986 to this issue. Stronghold contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and is therefore vulnerable to these issues. Users of Stronghold are advised to patch or upgrade their servers.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated versions of the Apache HTTP server, PHP, and mod_ssl are now\navailable which close possible buffer overflows in the Apache HTTP server\nbenchmarking tool, fixes two cross-site scripting vulnerabilities in the\nerror pages, and fix possible local privilege escalation.  These updates\nalso fix vulnerabilities in the PHP mail() function that allows script\nauthors to bypass safe mode restrictions, and possibly allow remote\nattackers to insert arbitrary mail headers and content into messages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.  PHP is an HTML-embedded scripting language\ncommonly used with the Apache HTTP server.\n\nBuffer overflows in the ApacheBench support program (ab.c) in Apache\nversions prior to 1.3.27, allow a malicious Web server to cause a denial of\nservice and possibly execute arbitrary code via a long response.  The\nCommon Vulnerabilities and Exposures project has assigned the name\nCAN-2002-0843 to this issue.\n\nTwo cross-site scripting vulnerabilities are present in the error pages\nfor the default \"404 Not Found\" error, and for the error response when a\nplain HTTP request is received on an SSL port.  Both of these issues are\nonly exploitable if the \"UseCanonicalName\" setting has been changed to\n\"Off\", and wildcard DNS is in use, and would allow remote attackers\nto execute scripts as other Web page visitors, for instance, to steal\ncookies.  These issues affect Apache versions 1.3 to 1.3.26,\nand mod_ssl versions before 2.8.12.  The Common Vulnerabilities and\nExposures project has assigned the names CAN-2002-0840 and\nCAN-2002-1157 to these issues.\n\nThe shared memory scoreboard in the HTTP daemon for Apache 1.3.x, prior to\nversion 1.3.27, allowed a user running as the web server user to send a\nSIGUSR1 signal to any process as root, resulting in a denial of service\n(process kill) or other such behavior that would not normally be allowed. \nThe Common Vulnerabilities and Exposures project has assigned the name\nCAN-2002-839 to this issue.\n\nThe mail function in PHP 4.x to 4.2.2 may allow local script authors to\nbypass safe mode restrictions and modify command line arguments to the\nMTA (such as Sendmail) in the fifth argument to mail(), altering MTA\nbehavior and possibly executing arbitrary local commands. The Common\nVulnerabilities and Exposures project has assigned the name CAN-2002-0985\nto this issue.\n\nThe mail function in PHP 4.x to 4.2.2 does not filter ASCII control\ncharacters from its arguments, which could allow remote attackers to\nmodify mail message content, including mail headers, and possibly use\nPHP as a \"spam proxy\". The Common Vulnerabilities and Exposures project has\nassigned the name CAN-2002-0986 to this issue.\n\nStronghold contains Apache 1.3.22, mod_ssl 2.8.7, and PHP 4.1.2, and\nis therefore vulnerable to these issues. Users of Stronghold are advised to\npatch or upgrade their servers.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2002:243",
        "url": "https://access.redhat.com/errata/RHSA-2002:243"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "http://www.apacheweek.com/issues/02-10-04",
        "url": "http://www.apacheweek.com/issues/02-10-04"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_243.json"
      }
    ],
    "title": "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold",
    "tracking": {
      "current_release_date": "2024-11-21T22:31:21+00:00",
      "generator": {
        "date": "2024-11-21T22:31:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2002:243",
      "initial_release_date": "2002-11-08T11:15:00+00:00",
      "revision_history": [
        {
          "date": "2002-11-08T11:15:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2002-10-07T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:31:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Stronghold 3",
                "product": {
                  "name": "Red Hat Stronghold 3",
                  "product_id": "Red Hat Stronghold 3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:stronghold:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Stronghold Cross Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2002-0839",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0839",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0839"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0839"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0840",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is \"Off\" and support for wildcard DNS is present, allows remote attackers to execute script as other web page visitors via the Host: header, a different vulnerability than CAN-2002-1157.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0840",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0840"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0840"
        }
      ],
      "release_date": "2002-10-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0843",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0843",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0843"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0843"
        }
      ],
      "release_date": "2002-10-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0985",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavior and possibly executing commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0985",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0985"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0985"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0986",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a \"spam proxy.\"",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0986"
        }
      ],
      "release_date": "2002-08-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1157",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Stronghold 3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1157",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1157"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1157"
        }
      ],
      "release_date": "2002-10-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-11-08T11:15:00+00:00",
          "details": "Backported fixes are available for the versions of Apache, mod_ssl, and PHP\nincluded in Stronghold 3.  Stronghold 3 build code 3020 is now available\nwhich includes this fix, and can be downloaded from the following URL:\n\nhttp://stronghold.redhat.com/sh3/\n\nFor information on how to upgrade between releases of Stronghold 3, refer\nto the following URL:\n\nhttp://stronghold.redhat.com/support/upgrade-sh3.xml",
          "product_ids": [
            "Red Hat Stronghold 3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2002:243"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.