Yellow Dog Linux Security Advisory: YDU-20020801-1

[Dan Burcaw]

Yellow Dog Linux Security Announcement
--------------------------------------

Package:	mod_ssl
Issue Date: 	August 1, 2002	
Priority:	high	
Advisory ID: 	YDU-20020801-1


1. 	Topic:

	Updated mod_ssl packages are available.


2. 	Problem:

	"Updated mod_ssl packages are now available for [Yellow Dog Linux 2.2
	and 2.3].  These updates incorporate a fix for an incorrect bounds check
	in versions of mod_ssl up to and including version 2.8.9.

	The mod_ssl module provides strong cryptography for the Apache Web
	server via the Secure Sockets Layer (SSL) and Transport Layer Security
	(TLS) protocols. Versions of mod_ssl prior to 2.8.10 are subject to a
	single NULL overflow that can cause arbitrary code execution.

	In order to exploit this vulnerability, the Apache Web server has to be
	configured to allow overriding of configuration settings on a per-directory
	basis, and untrusted local users must be able to modify a directory in
	which the server is configured to allow overriding. The local attacker may
	then become the user that Apache is running as (usually 'www' or 'nobody').

	Note that regardless of this bug, local users can obtain the same
	privileges if the server is configured to allow them to create CGI scripts
	which run as the Web server user, or if PHP is enabled but not configured
	in "safe mode".

	The errata packages contain versions of mod_ssl that have been patched and
	are not vulnerable to this issue.

	Please note that you must restart the httpd daemon to use the updated
	module." 
	(from Red Hat Advisory)

3. 	Solution:

   	a) Updating via apt...
   	We suggest that you use the apt-get program to keep your
   	system up-to-date. The following command(s) will retrieve
   	and install the fixed version of this update onto your system:

		apt-get update
		apt-get install mod_ssl

   	b) Updating manually...
	Download the updates below for your version of Yellow Dog Linux
	and then run the following rpm command.
   	(Please use a mirror site)

		rpm -Fvh [filenames]

		Yellow Dog Linux 2.3
			  ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.3/
				ppc/mod_ssl-2.8.5-6.2.3a.ppc.rpm

		Yellow Dog Linux 2.2
			  ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.2/
				ppc/mod_ssl-2.8.5-6.2.2a.ppc.rpm
			  	

4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
[Yellow Dog Linux 2.3]
c603aa9e18db9d152c1341af544d9d05  SRPMS/mod_ssl-2.8.5-6.2.3a.src.rpm
43e820d2f59a11a4ed88d857702912aa  ppc/mod_ssl-2.8.5-6.2.3a.ppc.rpm

[Yellow Dog Linux 2.2]
e98cf5e4215ae5ec6144f79290d29269  SRPMS/mod_ssl-2.8.5-6.2.2a.src.rpm
bfd7e72a163893c0789bdd7bddb1ef86  ppc/mod_ssl-2.8.5-6.2.2a.ppc.rpm

I wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of apt-get, see:
http://www.yellowdoglinux.com/support/solutions/ydl_general/apt-get.shtml