SOT Linux Security Advisory
| Subject: | Updated apache package for SOT Linux 2003 |
| Advisory ID: | SLSA-2003:53 |
| Date: | Thursday, November 20, 2003 |
| Product: | SOT Linux 2003 |
1. Problem description
The Apache HTTP server is a powerful, full-featured, efficient,
and freely-available Web server.
A buffer overflow could occur in mod_alias and mod_rewrite when
a regular expression with more than 9 captures is configured. Users
who can create or modify configuration files (httpd.conf or
.htaccess, for example) could trigger this.
The Common Vulnerabilities and Exposures project(cve.mitre.org/) has assigned the name
CAN-2003-0542 to this issue.
2. Updated packages
SOT Linux 2003 Server:
i386:
ftp://ftp.sot.com/updates/2003/Server/i386/apache-1.3.29-2.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/apache-devel-1.3.29-2.i386.rpm
ftp://ftp.sot.com/updates/2003/Server/i386/apache-manual-1.3.29-2.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/apache-1.3.29-2.src.rpm
3. Upgrading package
Before applying this update, make sure all previously released
errata relevant to your system have been applied. Use up2date to
automatically upgrade the fixed packages.
If you want to upgrade manually, download the updated package
from the SOT Linux FTP site (use the links above) or from one of
our mirrors. The list of mirrors can be obtained at www.sot.com/en/linux
Update the package with the following command: rpm -Uvh
<filename>
4. Verification
All packages are PGP signed by SOT for security.
You can verify each package with the following command: rpm
–checksig <filename>
If you wish to verify the integrity of the downloaded package,
run “md5sum <filename>” and compare the output with data
given below.
Package Name MD5 sum
/Server/i386/apache-1.3.29-2.i386.rpm
ed4fdab557ee218bb9f699e47007a82a
/Server/i386/apache-devel-1.3.29-2.i386.rpm
e545dd6fd64e88120926f8e26bddad35
/Server/i386/apache-manual-1.3.29-2.i386.rpm
9463ada098d7939ab68b3ea7ecb98272
/Server/SRPMS/apache-1.3.29-2.src.rpm
082ab53f569dfab8b077e4f4d143078c
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542
Copyright(c) 2001-2003 SOT