Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


Top White Papers

More on LinuxToday


SOT Linux Advisory: apache

Nov 20, 2003, 15:59 (1 Talkback[s])

SOT Linux Security Advisory

Subject: Updated apache package for SOT Linux 2003
Advisory ID: SLSA-2003:53
Date: Thursday, November 20, 2003
Product: SOT Linux 2003

1. Problem description

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server.

A buffer overflow could occur in mod_alias and mod_rewrite when a regular expression with more than 9 captures is configured. Users who can create or modify configuration files (httpd.conf or .htaccess, for example) could trigger this.

The Common Vulnerabilities and Exposures project(cve.mitre.org/) has assigned the name CAN-2003-0542 to this issue.

2. Updated packages

SOT Linux 2003 Server:

i386:
ftp://ftp.sot.com/updates/2003/Server/i386/apache-1.3.29-2.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/apache-devel-1.3.29-2.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/apache-manual-1.3.29-2.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/apache-1.3.29-2.src.rpm

3. Upgrading package

Before applying this update, make sure all previously released errata relevant to your system have been applied. Use up2date to automatically upgrade the fixed packages.

If you want to upgrade manually, download the updated package from the SOT Linux FTP site (use the links above) or from one of our mirrors. The list of mirrors can be obtained at www.sot.com/en/linux

Update the package with the following command: rpm -Uvh <filename>

4. Verification

All packages are PGP signed by SOT for security.

You can verify each package with the following command: rpm --checksig <filename>

If you wish to verify the integrity of the downloaded package, run "md5sum <filename>" and compare the output with data given below.

Package Name MD5 sum


/Server/i386/apache-1.3.29-2.i386.rpm ed4fdab557ee218bb9f699e47007a82a
/Server/i386/apache-devel-1.3.29-2.i386.rpm e545dd6fd64e88120926f8e26bddad35
/Server/i386/apache-manual-1.3.29-2.i386.rpm 9463ada098d7939ab68b3ea7ecb98272
/Server/SRPMS/apache-1.3.29-2.src.rpm 082ab53f569dfab8b077e4f4d143078c

5. References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542

Copyright(c) 2001-2003 SOT