-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:183 http://www.mandriva.com/security/ _______________________________________________________________________ Package : apache-mod_security Date : July 31, 2009 Affected: Corporate 4.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in mod_security: Multiple unspecified vulnerabilities in the ModSecurity (aka mod_security) module 2.5.0 through 2.5.5 for the Apache HTTP Server, when SecCacheTransformations is enabled, allow remote attackers to cause a denial of service (daemon crash) or bypass the product's functionality via unknown vectors related to transformation caching. (CVE-2008-5676) The multipart processor in ModSecurity before 2.5.9 allows remote attackers to cause a denial of service (crash) via a multipart form datapost request with a missing part header name, which triggers a NULL pointer dereference (CVE-2009-1902). The PDF XSS protection feature in ModSecurity before 2.5.8 allows remote attackers to cause a denial of service (Apache httpd crash) via a request for a PDF file that does not use the GET method (CVE-2009-1903). This update provides mod_security 2.5.9, which is not vulnerable to these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5676 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1902 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1903 _______________________________________________________________________ Updated Packages: Corporate 4.0: d669e1afaa7897339ecee3414fdc22c2 corporate/4.0/i586/apache-mod_security-2.5.9-0.1.20060mlcs4.i586.rpm 29c63f3d7c72198ee1b4d34b1246d5ca corporate/4.0/i586/mlogc-2.5.9-0.1.20060mlcs4.i586.rpm 51079e8acb4b14a3b45341c4a6e6ff3d corporate/4.0/SRPMS/apache-mod_security-2.5.9-0.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 3e8ac88721c75d5b78a3c16c838f780b corporate/4.0/x86_64/apache-mod_security-2.5.9-0.1.20060mlcs4.x86_64.rpm b2fd07f2e07a4c25573f5efb1905af62 corporate/4.0/x86_64/mlogc-2.5.9-0.1.20060mlcs4.x86_64.rpm 51079e8acb4b14a3b45341c4a6e6ff3d corporate/4.0/SRPMS/apache-mod_security-2.5.9-0.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKcvAOmqjQ0CJFipgRAk/3AJ9HOmC1pUabr+0Kwex3nQMthCplLACgzgLc kclJBZGXrnCUvANxp718v/s= =o+dG -----END PGP SIGNATURE-----
