Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 66807 - net-www/apache-2, net-www/mod_ssl: SSLCipherSuite bypass (CAN-2004-0885)
Summary: net-www/apache-2, net-www/mod_ssl: SSLCipherSuite bypass (CAN-2004-0885)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
URL: http://issues.apache.org/bugzilla/sho...
Whiteboard: A3 [glsa] vorlon
Keywords:
: 67711 (view as bug list)
Depends on:
Blocks:
 
Reported: 2004-10-08 13:55 UTC by Stuart Herbert (RETIRED)
Modified: 2011-10-30 22:39 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stuart Herbert (RETIRED) gentoo-dev 2004-10-08 13:55:35 UTC 
I've added net-www/apache-2.0.52 to the Portage tree.  This package includes an additional patch to address security issue CAN-2004-0885.

It's ready for testing and marking stable on all arches.

My thanks to Paul Querna <pquerna@apache.org> for letting us know about this.

Best regards,
Stu
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2004-10-08 14:06:30 UTC 
Arches: please mark net-www/apache-2.0.52 stable :)
Comment 2 Jason Wever (RETIRED) gentoo-dev 2004-10-08 19:40:48 UTC 
Stable on sparc.
Comment 3 Bryan Østergaard (RETIRED) gentoo-dev 2004-10-09 05:14:53 UTC 
Stable on alpha.
Comment 4 Jochen Maes (RETIRED) gentoo-dev 2004-10-09 05:19:32 UTC 
stable on ppc
Comment 5 Tom Gall (RETIRED) gentoo-dev 2004-10-09 11:32:08 UTC 
stable on ppc64, thanks!
Comment 6 SpanKY gentoo-dev 2004-10-11 18:54:25 UTC 
arm/hppa/ia64/s390 stable
Comment 7 Thierry Carrez (RETIRED) gentoo-dev 2004-10-13 02:42:41 UTC 
x86, amd64: please mark stable so that the GLSA can go out.
Comment 8 Olivier Crete (RETIRED) gentoo-dev 2004-10-13 09:53:39 UTC 
x86 stable..
Comment 9 Hardave Riar (RETIRED) gentoo-dev 2004-10-14 03:15:54 UTC 
Stable on mips.
Comment 10 Matthias Geerdsen (RETIRED) gentoo-dev 2004-10-15 12:24:07 UTC 
apache herd, mod_ssl seems vulnerable to this too and version 2.8.20 is out to fix this

CHANGES entry for this version:

Changes with mod_ssl 2.8.20 (16-Jul-2004 to 15-Oct-2004)

   *) With OpenSSL 0.9.7, prevent session resumption during a
      renegotiation to force the client to negotiate a new (and
      acceptable to mod_ssl) cipher suite. Additionally, ensure
      that a correct cipher suite has been negotiated afterwards
      (CAN-2004-0885).

   *) Fixed more printf(3) style format string bugs (not security
      related) which could crash the server if mod_ssl's trace
      or debug log level is enabled

___
http://secunia.com/advisories/12847/
VE reference:	CAN-2004-0885

Description:
Hartmut Keil has reported a security issue in mod_ssl, which can be exploited by malicious people to bypass certain security restrictions.

For more information:
SA12787

Solution:
Update to version 2.8.20-1.3.31.
http://www.modssl.org/

Provided and/or discovered by:
Hartmut Keil
Comment 11 Thierry Carrez (RETIRED) gentoo-dev 2004-10-15 13:43:44 UTC 
*** Bug 67711 has been marked as a duplicate of this bug. ***
Comment 12 Matthias Geerdsen (RETIRED) gentoo-dev 2004-10-18 00:37:05 UTC 
removing amd64 since apache is all done already, thanks Kugelfang :-)

any progress on an updated mod_ssl ebuild?
Comment 13 Thierry Carrez (RETIRED) gentoo-dev 2004-10-19 00:49:48 UTC 
Apache team, please bump mod_ssl to 2.8.20...
Comment 14 Bryan Østergaard (RETIRED) gentoo-dev 2004-10-20 18:51:10 UTC 
mod_ssl-2.8.20 is now in cvs.
Comment 15 Luke Macken (RETIRED) gentoo-dev 2004-10-20 21:34:38 UTC 
mod_ssl-2.8.20 marked stable by maintainer.

marking glsa bug-ready.
Comment 16 Thierry Carrez (RETIRED) gentoo-dev 2004-10-22 01:21:32 UTC 
GLSA 200410-21