ID de Prueba:	1.3.6.1.4.1.25623.1.0.51242
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2002:136
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2002:136. Updated mod_ssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9. The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Versions of mod_ssl prior to 2.8.10 are subject to a single NULL overflow that can cause arbitrary code execution. In order to exploit this vulnerability, the Apache Web server has to be configured to allow overriding of configuration settings on a per-directory basis, and untrusted local users must be able to modify a directory in which the server is configured to allow overriding. The local attacker may then become the user that Apache is running as (usually 'www' or 'nobody'). Note that regardless of this bug, local users can obtain the same privileges if the server is configured to allow them to create CGI scripts which run as the Web server user, or if PHP is enabled but not configured in 'safe mode'. The errata packages contain versions of mod_ssl that have been patched and are not vulnerable to this issue. Please note that you must restart the httpd daemon to use the updated module. For instructions on doing this, see the bottom of the Solutions section below. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2002-136.html http://marc.theaimsgroup.com/?l=apache-modssl&m=102491918531562 Risk factor : Medium CVSS Score: 4.6
Referencia Cruzada:	BugTraq ID: 5084 Common Vulnerability Exposure (CVE) ID: CVE-2002-0653 http://www.securityfocus.com/bid/5084 Bugtraq: 20020624 Apache mod_ssl off-by-one vulnerability (Google Search) http://marc.info/?l=bugtraq&m=102513970919836&w=2 Bugtraq: 20020628 TSL-2002-0058 - apache/mod_ssl (Google Search) http://archives.neohapsis.com/archives/bugtraq/2002-06/0350.html Caldera Security Advisory: CSSA-2002-031.0 ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-031.0.txt Conectiva Linux advisory: CLA-2002:504 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000504 Debian Security Information: DSA-135 (Google Search) http://www.debian.org/security/2002/dsa-135 En Garde Linux Advisory: ESA-20020702-017 http://marc.info/?l=bugtraq&m=102563469326072&w=2 HPdes Security Advisory: HPSBTL0207-052 http://archives.neohapsis.com/archives/hp/2002-q3/0018.html http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-048.php http://www.redhat.com/support/errata/RHSA-2002-134.html http://www.redhat.com/support/errata/RHSA-2002-135.html http://www.redhat.com/support/errata/RHSA-2002-136.html http://www.redhat.com/support/errata/RHSA-2002-146.html RedHat Security Advisories: RHSA-2002:164 http://rhn.redhat.com/errata/RHSA-2002-164.html http://www.redhat.com/support/errata/RHSA-2003-106.html SuSE Security Announcement: SuSE-SA:2002:028 (Google Search) http://www.novell.com/linux/security/advisories/2002_028_mod_ssl.html http://marc.info/?l=vuln-dev&m=102477330617604&w=2 http://www.iss.net/security_center/static/9415.php
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.