Linux News
The world is talking about GNU/Linux and Free/Open Source Software

SuSE alert: mod_ssl, mm

Posted by dave on Jul 31, 2002 8:20 AM EDT
Mailing list

This security announcement covers two different errors in packages used by and used with the apache package. The first bug is an off-by-one overflow in the code responsible for handling configuration directives in mod_ssl, the apache module that enables apache to serve SSL encrypted http protocol. This vulnerability allows a local attacker to use a specially prepared .htaccess file for a denial of service attack against a webserver child, resulting in an increased resource usage overhead on busy webservers, or possibly to execute arbitrary commands as the webserver user (wwwrun in the SuSE case). This bug has been discovered by Frank Denis. The second bug was found by Markus Meissner (while working for Caldera in 2001, now SuSE) and Sebastian Krahmer, SuSE Security, independently. It is a temporary file handling problem in libmm (package name is "mm"), a library for communication between forked processes using IPC semaphores, IPC shared memory and/or shared mmap()'ed files. The vulnerability allows a local attacker to gain root privileges once she has succeeded to gain the (local) privileges of the user wwwrun on the system running the apache webserver.

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

SuSE Security Announcement

        Package: mod_ssl, mm
        Announcement-ID: SuSE-SA:2002:028
        Date: Wednesday, Jul 31st 2002 18:00 MEST
        Affected products: 7.0, 7.1, 7.2, 7.3, 8.0
                                SuSE Linux Database Server,
                                SuSE eMail Server 3.1,
                                SuSE Linux Enterprise Server,
                                SuSE Linux Firewall on CD
                                SuSE Linux Connectivity Server
                                SuSE Linux Office Server
        Vulnerability Type: local privilege escalation
        Severity (1-10): 5
                                8 for SuSE Linux 7.0
        SuSE default package: no
                                mm: yes for SuSE Linux 7.0
        Cross References:

    Content of this advisory:
        1) security vulnerability resolved: mod_ssl, mm
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

______________________________________________________________________________

1) problem description, brief discussion, solution, upgrade information

    This security announcement covers two different errors in packages used
    by and used with the apache package.
    The first bug is an off-by-one overflow in the code responsible for
    handling configuration directives in mod_ssl, the apache module that
    enables apache to serve SSL encrypted http protocol. This vulnerability
    allows a local attacker to use a specially prepared .htaccess file for
    a denial of service attack against a webserver child, resulting in
    an increased resource usage overhead on busy webservers, or possibly
    to execute arbitrary commands as the webserver user (wwwrun in the SuSE
    case). This bug has been discovered by Frank Denis.
    The second bug was found by Markus Meissner (while working for Caldera
    in 2001, now SuSE) and Sebastian Krahmer, SuSE Security, independently.
    It is a temporary file handling problem in libmm (package name is "mm"),
    a library for communication between forked processes using IPC semaphores,
    IPC shared memory and/or shared mmap()'ed files. The vulnerability allows
    a local attacker to gain root privileges once she has succeeded to gain
    the (local) privileges of the user wwwrun on the system running the apache
    webserver.

    The apache webserver consists of a core package named apache, plus a set
    of packages that provide additional functionality in the form of apache
    modules (that can be configured to be loaded at runtime). In addition to
    the security problems fixed, the apache package(s) now have improved
    package dependencies and package configuration that should make package
    management more transparent and that should add more stability to the
    packages as a result of a clearer structure. In order to have these
    improvements available for all packages in the apache group, we provide
    all packages that depend on the apache main package as well as all
    packages that the apache package depends on for download on our ftp
    server. Please see the package list for your distribution for details.

To find out which package you have installed (which package you need to
download), please use the command

rpm -q --whatrequires apache

    The command either shows an error message if apache is not installed,
    or it will show you the names of the packages in the form
        package-version-release

example: jserv-1.1.2-502
You would have to download and install the package jserv.

Alternatively, Yast Online Update (YOU), available in the menu from the
yast2 command, can do this work for you.

NOTE for users of the SuSE Linux 7.0 distribution:
----------------------------------------------------

    The preceding SuSE Security announcement about openssl (SuSE-SA:2002:027)
    offers fixes against a set of critical bugs in the openssl library.
    The mod_ssl apache module makes use of this library. If you have updated
    the openssl packages on your system according to SuSE-SA:2002:027 and if
    you have restarted your webserver as documented in the announcement,
    the freshly started webserver uses the new installed openssl shared
    libraries.
    On SuSE-7.0 systems the mod_ssl apache module (/usr/lib/apache/libssl.so)
    has been statically linked to the openssl library for technical reasons.
    By consequence, the update of the openssl package does not have any effect
    on the vulnerability present in the openssl part of the mod_ssl apache
    module on a SuSE Linux 7.0 system. The mod_ssl package provided for
    download from the 7.0 update trees on our ftp server are linked to
    the fixed openssl library. As a result of this circumstance, the
    SuSE Linux 7.0 distributions should receive special attention with
    regards to this announcement and the openssl announcement
    (SuSE-SA:2002:027).

    Please download the update package for your distribution and verify its
    integrity by the methods listed in section 3) of this announcement.
    Then, install the package using the command "rpm -Fhv file.rpm" to apply
    the update.
    Our maintenance customers are being notified individually. The packages
    are being offered to install from the maintenance web.

    (Brief note: Please see Section 2) of this announcement after the lengthy
    links list for corrections for SuSE-SA:2002:027 and additional
    information!)

Intel i386 Platform:

Sparc Platform:

AXP Alpha Platform:

    SuSE-7.0:
    The packages for the Alpha distribution version 7.0 are not complete yet.
    They will be stored on the ftp server as soon as they are ready.

PPC Power PC Platform:

SuSE-7.3:

Nav

» Read more about: Story Type: Security; Groups: SUSE

« Return to the newswire homepage

This topic does not have any threads posted yet!

You cannot post until you login.

Linux News
The world is talking about GNU/Linux and Free/Open Source Software

Login

Today's Big Story

LXer Features

Have something to say?

Latest Discussions

Site Menu

Other News

SuSE alert: mod_ssl, mm

Linux NewsThe world is talking about GNU/Linux and Free/Open Source Software

Login

Today's Big Story

LXer Features

Have something to say?

Latest Discussions

Site Menu

Other News

SuSE alert: mod_ssl, mm

Linux News
The world is talking about GNU/Linux and Free/Open Source Software