|
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SCO Security Advisory Subject: UnixWare 7.1.3 Open UNIX 8.0.0 UnixWare 7.1.1 : apache multiple vulnerabilities, upgraded to apache-1.3.29 Advisory number: SCOSA-2004.6 Issue date: 2004 May 04 Cross reference: sr886044 fz528423 erg712465 sr886995 fz528485 erg712487 ______________________________________________________________________________ 1. Problem Description The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to these issues. CAN-2003-0192: Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory re-negotiations and the SSLCipherSuite directive being used to upgrade from a weak cipher suite to a strong one," which could cause Apache to use the weak cipher suite. CAN-2003-0542: Multiple stack-based buffer overflows in mod_alias and mod_rewrite for Apache before 1.3.29 may allow attackers to create configuration files to cause a denial of service or execute arbitrary code via a regular expression with more than 9 captures. 2. Vulnerable Supported Versions System Binaries ---------------------------------------------------------------------- UnixWare 7.1.3 Apache distribution Open UNIX 8.0.0 Apache distribution UnixWare 7.1.1 Apache distribution 3. Solution The proper solution is to install the latest packages. 4. UnixWare 7.1.3 4.1 Location of Fixed Binaries ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6 4.2 Verification MD5 (apache.pkg) = fad2ad4be6468d378b1509b5726ff2c7 md5 is available for download from ftp://ftp.sco.com/pub/security/tools 4.3 Installing Fixed Binaries Upgrade the affected binaries with the following sequence: Download apache.pkg to the /var/spool/pkg directory # pkgadd -d /var/spool/pkg/apache.pkg 5. Open UNIX 8.0.0 5.1 First verify that openssl.097b-01.pkg has been installed. 5.2 Location of Fixed Binaries ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6 5.3 Verification MD5 (apache.pkg) = fad2ad4be6468d378b1509b5726ff2c7 md5 is available for download from ftp://ftp.sco.com/pub/security/tools 5.4 Installing Fixed Binaries Upgrade the affected binaries with the following sequence: Download apache.pkg to the /var/spool/pkg directory # pkgadd -d /var/spool/pkg/apache.pkg 6. UnixWare 7.1.1 6.1 First verify that openssl.097b-01.pkg has been installed. 6.2 Next verify that The latest UnixWare (UDK) Runtime Libraries are installed. The UDK Runtime Libraries can be found at http://www.sco.com/download/ Select the SCO Product Downloads link then select latest UnixWare (UDK) Runtime Libraries which of this writting is currently 7.1.3. 6.3 Location of Fixed Binaries ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6 6.4 Verification MD5 (apache.pkg) = fad2ad4be6468d378b1509b5726ff2c7 md5 is available for download from ftp://ftp.sco.com/pub/security/tools 6.5 Installing Fixed Binaries Upgrade the affected binaries with the following sequence: Download apache.pkg to the /var/spool/pkg directory # pkgadd -d /var/spool/pkg/apache.pkg 7. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0192 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0542 SCO security resources: http://www.sco.com/support/security/index.html SCO security advisories via email http://www.sco.com/support/forums/security.html This security fix closes SCO incidents sr886044 fz528423 erg712465 sr886995 fz528485 erg712487. 8. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (SCO/UNIX_SVR5) iD8DBQFAmDZNaqoBO7ipriERApF2AJ487+t+oerEoQbOR5BdYAqXAft1uQCfdYdp vnBoCZ83g7k4Y5WrdbugAxg= =Tu+q -----END PGP SIGNATURE-----