Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


More on LinuxToday


Gentoo Linux Advisories: apache, tomcat

Oct 15, 2002, 20:19 (0 Talkback[s])

- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200210-002
- - --------------------------------------------------------------------

PACKAGE : apache
SUMMARY : shared memory scoreboard vulnerabilities
EXPLOIT : local
DATE    : 2002-10-15 08:25 UTC

- - --------------------------------------------------------------------

Apache HTTP Server contains a vulnerability in its shared memory 
scoreboard. Attackers who can execute commands under the Apache
UID can either send a (SIGUSR1) signal to any process as root, in 
most cases killing the process, or launch a local denial of service (DoS)
attack.

Read the full advisory at
http://www.idefense.com/advisory/10.03.02.txt

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-www/apache-1.3.26-r4 and earlier update their systems
as follows:

emerge rsync
emerge apache
emerge clean

- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------

- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200210-001
- - --------------------------------------------------------------------

PACKAGE : tomcat
SUMMARY : source disclosure
EXPLOIT : remote
DATE    : 2002-10-15 08:15 UTC

- - --------------------------------------------------------------------

A security vulnerability has been confirmed to exist in Apache Tomcat
4.0.x releases (including Tomcat 4.0.5), which allows to use a specially
crafted URL to return the unprocessed source of a JSP page, or, under
special circumstances, a static resource which would otherwise have been
protected by security constraint, without the need for being properly
authenticated. This is based on a variant of the exploit that was
disclosed on 09/24/2002.

Read the full disclosure at
http://marc.theaimsgroup.com/?l=tomcat-dev&m=103417249325526&w=2

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-www/tomcat-4.0.5 and earlier update their systems
as follows:

emerge rsync
emerge tomcat
emerge clean

- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------