90952 2003-02-17 23:14 /173 rader/ <security@caldera.com> Importerad: 2003-02-17 23:14 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Extern mottagare: full-disclosure@lists.netsys.com Externa svar till: please_reply_to_security@caldera.com Mottagare: Bugtraq (import) <3530> Ärende: Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability ------------------------------------------------------------ To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com full-disclosure@lists.netsys.com ______________________________________________________________________________ SCO Security Advisory Subject: Linux: Apache mod_dav module format string vulnerability Advisory number: CSSA-2003-007.0 Issue date: 2003 February 17 Cross reference: ______________________________________________________________________________ 1. Problem Description The Apache mod_dav module contains a format string vulnerability in the "ap_log_rerror()" function. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to mod_dav-1.0.2_1.3.6-3.i386.rpm prior to mod_dav-devel-1.0.2_1.3.6-3.i386.rpm OpenLinux 3.1.1 Workstation prior to mod_dav-1.0.2_1.3.6-3.i386.rpm prior to mod_dav-devel-1.0.2_1.3.6-3.i386.rpm OpenLinux 3.1 Server prior to mod_dav-1.0.2_1.3.6-3.i386.rpm prior to mod_dav-devel-1.0.2_1.3.6-3.i386.rpm OpenLinux 3.1 Workstation prior to mod_dav-1.0.2_1.3.6-3.i386.rpm prior to mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-007.0/RPMS 4.2 Packages bcb45e6cffe4b274dd2363b6880a9164 mod_dav-1.0.2_1.3.6-3.i386.rpm ef8f5066aa46ee037f69550b8438a322 mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 4.3 Installation rpm -Fvh mod_dav-1.0.2_1.3.6-3.i386.rpm rpm -Fvh mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-007.0/SRPMS 4.5 Source Packages d28984d21aca280a74588b98459a9e4e mod_dav-1.0.2_1.3.6-3.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-007.0/RPMS 5.2 Packages ddace8089a1a4eea49db6b86b10ad38f mod_dav-1.0.2_1.3.6-3.i386.rpm 83d069194ae139ea7e967fcfb6679db1 mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 5.3 Installation rpm -Fvh mod_dav-1.0.2_1.3.6-3.i386.rpm rpm -Fvh mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-007.0/SRPMS 5.5 Source Packages fa28668cc98cac3ad22eee23e77c2693 mod_dav-1.0.2_1.3.6-3.src.rpm 6. OpenLinux 3.1 Server 6.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2003-007.0/RPMS 6.2 Packages 3853d37862ee61ddd9720fdf17d58bf4 mod_dav-1.0.2_1.3.6-3.i386.rpm 739ca25c48cf6708066d94526bf2ec7d mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 6.3 Installation rpm -Fvh mod_dav-1.0.2_1.3.6-3.i386.rpm rpm -Fvh mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 6.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2003-007.0/SRPMS 6.5 Source Packages 35f41886e5019c46aa2504f5c3338c2e mod_dav-1.0.2_1.3.6-3.src.rpm 7. OpenLinux 3.1 Workstation 7.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2003-007.0/RPMS 7.2 Packages 9bce03b0080e3f088c315fd7ed0eee49 mod_dav-1.0.2_1.3.6-3.i386.rpm 6105508bfa30dec40785269e97152836 mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 7.3 Installation rpm -Fvh mod_dav-1.0.2_1.3.6-3.i386.rpm rpm -Fvh mod_dav-devel-1.0.2_1.3.6-3.i386.rpm 7.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2003-007.0/SRPMS 7.5 Source Packages 83429117c53516e8e94e1c36e25446f5 mod_dav-1.0.2_1.3.6-3.src.rpm 8. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0842 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr869830, fz526205, erg712132. 9. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 10. Acknowledgements David Litchfield discovered and investigated this vulnerability. ______________________________________________________________________________ (90952) / <security@caldera.com>/---------(Ombruten) Bilaga (application/pgp-signature) i text 90953 90953 2003-02-17 23:14 /9 rader/ <security@caldera.com> Importerad: 2003-02-17 23:14 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Extern mottagare: full-disclosure@lists.netsys.com Externa svar till: please_reply_to_security@caldera.com Mottagare: Bugtraq (import) <3531> Bilaga (text/plain) till text 90952 Ärende: Bilaga till: Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability ------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (SCO_SV) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj5RV/gACgkQbluZssSXDTHv/wCffMliK852RjwzCUI1jZUgw6B9 sFcAoNrV0mGfC86dU8fEXe3R8Ehvct9A =GBks -----END PGP SIGNATURE----- (90953) / <security@caldera.com>/------------------- 91051 2003-02-18 19:57 /8 rader/ <security@caldera.com> Importerad: 2003-02-18 19:57 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Extern mottagare: full-disclosure@lists.netsys.com Externa svar till: please_reply_to_security@caldera.com Mottagare: Bugtraq (import) <3553> Ärende: CSSA-2003-007.0 Advisory withdrawn. Re: Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability ------------------------------------------------------------ To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com full-disclosure@lists.netsys.com This update contained a vulnerable version of the mod_dav module. The update has been withdrawn, and is no longer available. SCO Security (91051) / <security@caldera.com>/------------------- Bilaga (application/pgp-signature) i text 91052 91052 2003-02-18 19:57 /9 rader/ <security@caldera.com> Importerad: 2003-02-18 19:57 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Extern mottagare: full-disclosure@lists.netsys.com Externa svar till: please_reply_to_security@caldera.com Mottagare: Bugtraq (import) <3554> Bilaga (text/plain) till text 91051 Ärende: Bilaga till: CSSA-2003-007.0 Advisory withdrawn. Re: Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability ------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (SCO_SV) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj5SfwAACgkQbluZssSXDTFbaACfRNzWlL6zjB+ZMJScBwrvTqhl 9UIAoJaxgLD4Gj/H68agX4DDqMhwFYr6 =hI3F -----END PGP SIGNATURE----- (91052) / <security@caldera.com>/------------------- 91054 2003-02-18 23:06 /40 rader/ Mark J Cox <mjc@apache.org> Importerad: 2003-02-18 23:06 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Mottagare: Bugtraq (import) <3555> Ärende: Re: CSSA-2003-007.0 Advisory withdrawn. ------------------------------------------------------------ -----BEGIN PGP SIGNED MESSAGE----- Just to clarify this a bit further, the mod_dav module for Apache is not vulnerable to the format string vulnerability (as outlined in the original advisory from SCO, CAN-2002-0842) mod_dav contains code that logs various errors and uses ap_log_rerror() to do so. In mod_dav for Apache, ap_log_rerror is never called with strings that can be influenced by a remote user. Now Oracle added code to their version of mod_dav to log gateway errors, but gateway errors contain strings that can be controlled by a remote user. Therefore Oracle was vulnerable to a format string issue, but no base release of Apache with mod_dav was vulnerable. We did some research this morning after SCO released their advisory. According to their ftp site SCO shipped OpenLinux with a standard copy of mod_dav which was not vulnerable to this format string issue. Their advisory, CSSA-2003-007.0 referenced new packages where they added a patch which, unfortunately, added in code to log of gateway errors and contained a format string vulnerability. Thanks, Mark -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQCVAwUBPlKFj+6tTP1JpWPZAQE6awQA43RYlKHCZME4KszH/zDOMbuTeTUybvaW GWP88jowg0+JtVDl+D7JFGFxdgrrxBD/sWTPRV361l3TKUYXnXcuDIW2OnWdWRtq 4zulMANv1kFs/mqRPz1naJ+hZPaVrYKVxSv2mhDz4fjohsBjUVlNOuaoosONl0se lWS9MFQTRaI= =mhD7 -----END PGP SIGNATURE----- (91054) /Mark J Cox <mjc@apache.org>/-----(Ombruten)