The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following names to these issues.
CAN-2003-0192: Apache 2 before 2.0.47, and certain versions
of mod_ssl for Apache 1.3, do not properly handle "certain
sequences of per-directory re-negotiations and the
SSLCipherSuite directive being used to upgrade from a weak
cipher suite to a strong one," which could cause Apache
to use the weak cipher suite.
CAN-2003-0542: Multiple stack-based buffer overflows in
mod_alias and mod_rewrite for Apache before 1.3.29 may allow
attackers to create configuration files to cause a denial of
service or execute arbitrary code via a regular expression
with more than 9 captures.
2. Vulnerable Supported Versions
System Binaries
----------------------------------------------------------------------
UnixWare 7.1.3 Apache distribution
Open UNIX 8.0.0 Apache distribution
UnixWare 7.1.1 Apache distribution
3. Solution
The proper solution is to install the latest packages.
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
6.5 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
Download apache.pkg to the /var/spool/pkg directory
# pkgadd -d /var/spool/pkg/apache.pkg
7. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers
intended to promote secure installation and use of SCO
products.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
______
SCO Security Advisory
Subject: UnixWare 7.1.3 Open UNIX 8.0.0 UnixWare 7.1.1 : apache multiple vulnerabilities, upgraded to apache-1.3.29
Advisory number: SCOSA-2004.6
Issue date: 2004 May 04
Cross reference: sr886044 fz528423 erg712465 sr886995 fz528485 erg712487
________________________________________________________________________
______
1. Problem Description
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the following names to these issues.
CAN-2003-0192: Apache 2 before 2.0.47, and certain versions
of mod_ssl for Apache 1.3, do not properly handle "certain
sequences of per-directory re-negotiations and the
SSLCipherSuite directive being used to upgrade from a weak
cipher suite to a strong one," which could cause Apache
to use the weak cipher suite.
CAN-2003-0542: Multiple stack-based buffer overflows in
mod_alias and mod_rewrite for Apache before 1.3.29 may allow
attackers to create configuration files to cause a denial of
service or execute arbitrary code via a regular expression
with more than 9 captures.
2. Vulnerable Supported Versions
System Binaries
----------------------------------------------------------------------
UnixWare 7.1.3 Apache distribution
Open UNIX 8.0.0 Apache distribution
UnixWare 7.1.1 Apache distribution
3. Solution
The proper solution is to install the latest packages.
4. UnixWare 7.1.3
4.1 Location of Fixed Binaries
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6
4.2 Verification
MD5 (apache.pkg) = fad2ad4be6468d378b1509b5726ff2c7
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
4.3 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
Download apache.pkg to the /var/spool/pkg directory
# pkgadd -d /var/spool/pkg/apache.pkg
5. Open UNIX 8.0.0
5.1 First verify that openssl.097b-01.pkg has been installed.
5.2 Location of Fixed Binaries
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6
5.3 Verification
MD5 (apache.pkg) = fad2ad4be6468d378b1509b5726ff2c7
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
5.4 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
Download apache.pkg to the /var/spool/pkg directory
# pkgadd -d /var/spool/pkg/apache.pkg
6. UnixWare 7.1.1
6.1 First verify that openssl.097b-01.pkg has been installed.
6.2 Next verify that The latest UnixWare (UDK) Runtime
Libraries are installed.
The UDK Runtime Libraries can be found at
http://www.sco.com/download/
Select the SCO Product Downloads link then
select latest UnixWare (UDK) Runtime Libraries
which of this writting is currently 7.1.3.
6.3 Location of Fixed Binaries
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6
6.4 Verification
MD5 (apache.pkg) = fad2ad4be6468d378b1509b5726ff2c7
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
6.5 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
Download apache.pkg to the /var/spool/pkg directory
# pkgadd -d /var/spool/pkg/apache.pkg
7. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542
SCO security resources:
http://www.sco.com/support/security/index.html
SCO security advisories via email
http://www.sco.com/support/forums/security.html
This security fix closes SCO incidents sr886044 fz528423
erg712465 sr886995 fz528485 erg712487.
8. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers
intended to promote secure installation and use of SCO
products.
________________________________________________________________________
______
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFAmDZNaqoBO7ipriERApF2AJ487+t+oerEoQbOR5BdYAqXAft1uQCfdYdp
vnBoCZ83g7k4Y5WrdbugAxg=
=Tu+q
-----END PGP SIGNATURE-----
[ reply ]