ID de Prueba:	1.3.6.1.4.1.25623.1.0.50758
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDKSA-2003:103 (apache)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to apache announced via advisory MDKSA-2003:103. A buffer overflow in mod_alias and mod_rewrite was discovered in Apache versions 1.3.19 and earlier as well as Apache 2.0.47 and earlier. This happens when a regular expression with more than 9 captures is confined. An attacker would have to create a carefully crafted configuration file (.htaccess or httpd.conf) in order to exploit these problems. As well, another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. Apache version 2.0.48 and 1.3.29 were released upstream to correct these bugs backported patches have been applied to the provided packages. Affected versions: 9.0, 9.1, 9.2, Corporate Server 2.1, Multi Network Firewall 8.2 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2003:103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0542 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0789 http://www.apache.org/dist/httpd/Announcement.html http://www.apache.org/dist/httpd/Announcement2.html Risk factor : Critical CVSS Score: 10.0
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0542 http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html BugTraq ID: 8911 http://www.securityfocus.com/bid/8911 BugTraq ID: 9504 http://www.securityfocus.com/bid/9504 Bugtraq: 20031028 [OpenPKG-SA-2003.046] OpenPKG Security Advisory (apache) (Google Search) http://www.securityfocus.com/archive/1/342674 Bugtraq: 20031031 GLSA: apache (200310-04) (Google Search) http://marc.info/?l=bugtraq&m=106761802305141&w=2 CERT/CC vulnerability note: VU#434566 http://www.kb.cert.org/vuls/id/434566 CERT/CC vulnerability note: VU#549142 http://www.kb.cert.org/vuls/id/549142 HPdes Security Advisory: HPSBOV02683 http://marc.info/?l=bugtraq&m=130497311408250&w=2 HPdes Security Advisory: HPSBUX0311-301 http://www.securityfocus.com/advisories/6079 HPdes Security Advisory: SSRT090208 Immunix Linux Advisory: IMNX-2003-7+-025-01 http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:103 https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3Ccvs.httpd.apache.org%3E https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3799 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A863 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A864 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9458 http://www.redhat.com/support/errata/RHSA-2003-320.html http://www.redhat.com/support/errata/RHSA-2003-360.html http://www.redhat.com/support/errata/RHSA-2003-405.html http://www.redhat.com/support/errata/RHSA-2004-015.html http://www.redhat.com/support/errata/RHSA-2005-816.html SCO Security Bulletin: CSSA-2003-SCO.28 SCO Security Bulletin: SCOSA-2004.6 ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6/SCOSA-2004.6.txt http://secunia.com/advisories/10096 http://secunia.com/advisories/10098 http://secunia.com/advisories/10102 http://secunia.com/advisories/10112 http://secunia.com/advisories/10114 http://secunia.com/advisories/10153 http://secunia.com/advisories/10260 http://secunia.com/advisories/10264 http://secunia.com/advisories/10463 http://secunia.com/advisories/10580 http://secunia.com/advisories/10593 SGI Security Advisory: 20031203-01-U ftp://patches.sgi.com/support/free/security/advisories/20031203-01-U.asc SGI Security Advisory: 20040202-01-U ftp://patches.sgi.com/support/free/security/advisories/20040202-01-U.asc http://sunsolve.sun.com/search/document.do?assetkey=1-26-101444-1 http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1 XForce ISS Database: apache-modalias-modrewrite-bo(13400) https://exchange.xforce.ibmcloud.com/vulnerabilities/13400 Common Vulnerability Exposure (CVE) ID: CVE-2003-0789 BugTraq ID: 8926 http://www.securityfocus.com/bid/8926 Computer Incident Advisory Center Bulletin: O-015 http://www.ciac.org/ciac/bulletins/o-015.shtml Conectiva Linux advisory: CLA-2003:775 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000775 http://security.gentoo.org/glsa/glsa-200310-04.xml https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4@%3Ccvs.httpd.apache.org%3E XForce ISS Database: apache-modcgi-info-disclosure(13552) https://exchange.xforce.ibmcloud.com/vulnerabilities/13552
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.