-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:193 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : apache Date : July 11, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in apache (ASF HTTPD): mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI (CVE-2013-1896). The updated packages have been upgraded to the latest 2.2.25 version which is not vulnerable to this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1896 http://httpd.apache.org/security/vulnerabilities_22.html http://www.apache.org/dist/httpd/CHANGES_2.2.25 _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: 74428d38a11260e9c8e66c2096cc1815 mes5/i586/apache-base-2.2.25-0.1mdvmes5.2.i586.rpm ef99b13e24656d5d2fdf6bacfccf4e71 mes5/i586/apache-conf-2.2.25-0.1mdvmes5.2.i586.rpm 6d31e1cf0b374d0c03a254ed57a1f467 mes5/i586/apache-devel-2.2.25-0.1mdvmes5.2.i586.rpm e7de8b165bb03db079efd2a3a37f537e mes5/i586/apache-doc-2.2.25-0.1mdvmes5.2.i586.rpm 710d058cccac3de097e590e6dd90944a mes5/i586/apache-htcacheclean-2.2.25-0.1mdvmes5.2.i586.rpm 0d04268ef8d9384e7ea0ed1e1813ed7a mes5/i586/apache-mod_authn_dbd-2.2.25-0.1mdvmes5.2.i586.rpm efe738920fa67624eb8e5dc9371ebce5 mes5/i586/apache-mod_cache-2.2.25-0.1mdvmes5.2.i586.rpm a27ce4545c26c09902182f460686c6b9 mes5/i586/apache-mod_dav-2.2.25-0.1mdvmes5.2.i586.rpm 47ef6587bdd08ca712f09711ca5aebe3 mes5/i586/apache-mod_dbd-2.2.25-0.1mdvmes5.2.i586.rpm debd225f26997295f9f134b5ef03eaf1 mes5/i586/apache-mod_deflate-2.2.25-0.1mdvmes5.2.i586.rpm 5d4feab915dd178652dda909fe4d45f4 mes5/i586/apache-mod_disk_cache-2.2.25-0.1mdvmes5.2.i586.rpm c1791f4ef3c793a5c9df4b03cfea2407 mes5/i586/apache-mod_file_cache-2.2.25-0.1mdvmes5.2.i586.rpm e43f45f40c594be8cb24a9a7da6d170a mes5/i586/apache-mod_ldap-2.2.25-0.1mdvmes5.2.i586.rpm 4834d67363fa96e13a46f7bd00ce8493 mes5/i586/apache-mod_mem_cache-2.2.25-0.1mdvmes5.2.i586.rpm 5ef573a28241172e907a8917f0b181c0 mes5/i586/apache-mod_proxy-2.2.25-0.1mdvmes5.2.i586.rpm 6010f92f994a81cb63f3f4488aa2da43 mes5/i586/apache-mod_proxy_ajp-2.2.25-0.1mdvmes5.2.i586.rpm 33d3d29122153699b90d81aceb2e21fa mes5/i586/apache-mod_proxy_scgi-2.2.25-0.1mdvmes5.2.i586.rpm 257c1cf46f1b37e9becd8646a001ea4e mes5/i586/apache-mod_reqtimeout-2.2.25-0.1mdvmes5.2.i586.rpm 9111ebcd2c948cafcda80c699dfe0168 mes5/i586/apache-mod_ssl-2.2.25-0.1mdvmes5.2.i586.rpm 9cc61bbe23ae03bce08858593e57fc66 mes5/i586/apache-mod_suexec-2.2.25-0.1mdvmes5.2.i586.rpm cedf1df8facd3f78b77f18fd90c634fc mes5/i586/apache-modules-2.2.25-0.1mdvmes5.2.i586.rpm a7b8090e403577f821f79738e008133b mes5/i586/apache-mod_userdir-2.2.25-0.1mdvmes5.2.i586.rpm d7154dc483edc17f2a06b14ec927a6a5 mes5/i586/apache-mpm-event-2.2.25-0.1mdvmes5.2.i586.rpm b6e2637d39fbe9af4712cc133bbd8782 mes5/i586/apache-mpm-itk-2.2.25-0.1mdvmes5.2.i586.rpm 9aae9446b9ed93f9e86fac2f0f56f18f mes5/i586/apache-mpm-peruser-2.2.25-0.1mdvmes5.2.i586.rpm 4942fe06be63a4be7960fe877f4742c0 mes5/i586/apache-mpm-prefork-2.2.25-0.1mdvmes5.2.i586.rpm 7bc44bdb05e448b0e4ce9e9c22cc2913 mes5/i586/apache-mpm-worker-2.2.25-0.1mdvmes5.2.i586.rpm 88d865382f4783f7bb948f3af029b10b mes5/i586/apache-source-2.2.25-0.1mdvmes5.2.i586.rpm 528dfc52f44fb7bf0fec6200f028063d mes5/SRPMS/apache-2.2.25-0.1mdvmes5.2.src.rpm 49b8eee01f15355b1c2f4f974776f9c2 mes5/SRPMS/apache-conf-2.2.25-0.1mdvmes5.2.src.rpm 6803e25ee43375a8302a89426d01382b mes5/SRPMS/apache-mod_suexec-2.2.25-0.1mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 6452960bec31ffd774ebee36bc54bf36 mes5/x86_64/apache-base-2.2.25-0.1mdvmes5.2.x86_64.rpm 59d55a174a4d828e3f26de393fc6767c mes5/x86_64/apache-conf-2.2.25-0.1mdvmes5.2.x86_64.rpm 52f4d81bc1e5bf036f7f976d35870609 mes5/x86_64/apache-devel-2.2.25-0.1mdvmes5.2.x86_64.rpm d5095a0a9638039a2219582658ea2829 mes5/x86_64/apache-doc-2.2.25-0.1mdvmes5.2.x86_64.rpm 70b872c6b6a8240ec394d2600a38a6d7 mes5/x86_64/apache-htcacheclean-2.2.25-0.1mdvmes5.2.x86_64.rpm bcf68f1bf2b3d3795f838b024a9d768e mes5/x86_64/apache-mod_authn_dbd-2.2.25-0.1mdvmes5.2.x86_64.rpm e02bae63b3250b5151ce439f91e11856 mes5/x86_64/apache-mod_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm e78eb3a2cba8651eb614f8fde497d137 mes5/x86_64/apache-mod_dav-2.2.25-0.1mdvmes5.2.x86_64.rpm 2a5180f9e243c6469ca8738c6873d0ea mes5/x86_64/apache-mod_dbd-2.2.25-0.1mdvmes5.2.x86_64.rpm 4cf24fbc6ed54f0df842cdc16ca1c7d2 mes5/x86_64/apache-mod_deflate-2.2.25-0.1mdvmes5.2.x86_64.rpm ca011efa4a592be9ce87068bba01f505 mes5/x86_64/apache-mod_disk_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm ce137ce1a31b9b2da83042bb2c24935f mes5/x86_64/apache-mod_file_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm 931c6eaa5627b2c466cd959dc7e61300 mes5/x86_64/apache-mod_ldap-2.2.25-0.1mdvmes5.2.x86_64.rpm 4902fed22c7c383134731cf3a4924e92 mes5/x86_64/apache-mod_mem_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm 74e556135f5b214dd3c6902aafef7c27 mes5/x86_64/apache-mod_proxy-2.2.25-0.1mdvmes5.2.x86_64.rpm 18aee4012faebb7a15ee2ce445bf0b08 mes5/x86_64/apache-mod_proxy_ajp-2.2.25-0.1mdvmes5.2.x86_64.rpm 38e7260f51e459307946a8f67bde2e8b mes5/x86_64/apache-mod_proxy_scgi-2.2.25-0.1mdvmes5.2.x86_64.rpm 444468976bcb21f539bac57a714272b9 mes5/x86_64/apache-mod_reqtimeout-2.2.25-0.1mdvmes5.2.x86_64.rpm 630424ff1d18e7bb6a7063e6dfd69c45 mes5/x86_64/apache-mod_ssl-2.2.25-0.1mdvmes5.2.x86_64.rpm a2ac6c44d134b106bec3506533cb534b mes5/x86_64/apache-mod_suexec-2.2.25-0.1mdvmes5.2.x86_64.rpm 328fa7cbd902b9814debeb8220883fe6 mes5/x86_64/apache-modules-2.2.25-0.1mdvmes5.2.x86_64.rpm 8a417231e1941ddb77402f4c61d24a86 mes5/x86_64/apache-mod_userdir-2.2.25-0.1mdvmes5.2.x86_64.rpm 0018ae820accd9721850bc5137904f90 mes5/x86_64/apache-mpm-event-2.2.25-0.1mdvmes5.2.x86_64.rpm 60b07648ddc2604dbc29774221549c02 mes5/x86_64/apache-mpm-itk-2.2.25-0.1mdvmes5.2.x86_64.rpm dfb8120702f08677ac0cfbf350626a33 mes5/x86_64/apache-mpm-peruser-2.2.25-0.1mdvmes5.2.x86_64.rpm 96e0576c0c276915343720cc316d305a mes5/x86_64/apache-mpm-prefork-2.2.25-0.1mdvmes5.2.x86_64.rpm 7ffeaffc2e86b21b118ee51bfea38d26 mes5/x86_64/apache-mpm-worker-2.2.25-0.1mdvmes5.2.x86_64.rpm cc4fb93cac638bcbda72e068f399b1af mes5/x86_64/apache-source-2.2.25-0.1mdvmes5.2.x86_64.rpm 528dfc52f44fb7bf0fec6200f028063d mes5/SRPMS/apache-2.2.25-0.1mdvmes5.2.src.rpm 49b8eee01f15355b1c2f4f974776f9c2 mes5/SRPMS/apache-conf-2.2.25-0.1mdvmes5.2.src.rpm 6803e25ee43375a8302a89426d01382b mes5/SRPMS/apache-mod_suexec-2.2.25-0.1mdvmes5.2.src.rpm Mandriva Business Server 1/X86_64: 90e479d61bbe4c07b06cca031b74e9c5 mbs1/x86_64/apache-2.2.25-1.mbs1.x86_64.rpm c446c45054157bc57b468d1c7f1ee804 mbs1/x86_64/apache-devel-2.2.25-1.mbs1.x86_64.rpm 76bb0fb4a59c0370aaec176dea66f693 mbs1/x86_64/apache-doc-2.2.25-1.mbs1.noarch.rpm 3def45aac7e9983ca2b23bd1ce0ed575 mbs1/x86_64/apache-htcacheclean-2.2.25-1.mbs1.x86_64.rpm 193c55dd324990043d411b2e06532954 mbs1/x86_64/apache-mod_authn_dbd-2.2.25-1.mbs1.x86_64.rpm f4ea9e3ea46bb8ce16bbc9dc1e31e7a6 mbs1/x86_64/apache-mod_cache-2.2.25-1.mbs1.x86_64.rpm 14c198a1e0bfebbbb7dcf2209a52067b mbs1/x86_64/apache-mod_dav-2.2.25-1.mbs1.x86_64.rpm a3728918d726719cb1b93614b3c06e5f mbs1/x86_64/apache-mod_dbd-2.2.25-1.mbs1.x86_64.rpm 68fa63361621f237afbe5af065827ebb mbs1/x86_64/apache-mod_deflate-2.2.25-1.mbs1.x86_64.rpm db2cc66ba253dbdbb11c5cea06fab9f5 mbs1/x86_64/apache-mod_disk_cache-2.2.25-1.mbs1.x86_64.rpm a4e22cc39938eb6061555e532e65c446 mbs1/x86_64/apache-mod_file_cache-2.2.25-1.mbs1.x86_64.rpm fe86db4e6deed7f917b5aea72fe70627 mbs1/x86_64/apache-mod_ldap-2.2.25-1.mbs1.x86_64.rpm 8c61c24ca7a5ac76697c92cfebde8a70 mbs1/x86_64/apache-mod_mem_cache-2.2.25-1.mbs1.x86_64.rpm 011b2a819656d5a550e161ef363df608 mbs1/x86_64/apache-mod_proxy-2.2.25-1.mbs1.x86_64.rpm c2201afe28c59ed0ec3b016e5be0ef77 mbs1/x86_64/apache-mod_proxy_ajp-2.2.25-1.mbs1.x86_64.rpm a8883c21f216a84bbc1cd218c34669c4 mbs1/x86_64/apache-mod_proxy_scgi-2.2.25-1.mbs1.x86_64.rpm 36b80d68aed432fd933f2fcdbaf805f7 mbs1/x86_64/apache-mod_reqtimeout-2.2.25-1.mbs1.x86_64.rpm 58f1b017f4729b6d0a72a04fb0f15ba5 mbs1/x86_64/apache-mod_ssl-2.2.25-1.mbs1.x86_64.rpm e10760da2d3f96d5bf10e365663ca4e5 mbs1/x86_64/apache-mod_suexec-2.2.25-1.mbs1.x86_64.rpm 31ce2edb42bdac89b1fc850bec9779a1 mbs1/x86_64/apache-mod_userdir-2.2.25-1.mbs1.x86_64.rpm 2ee1edc95d78126b46ca33bda2f4087c mbs1/x86_64/apache-mpm-event-2.2.25-1.mbs1.x86_64.rpm 72db5917a6cdcceaa152baceb37c002e mbs1/x86_64/apache-mpm-itk-2.2.25-1.mbs1.x86_64.rpm fd41ef0ca72ed6d761d4a2d1e0dd588b mbs1/x86_64/apache-mpm-peruser-2.2.25-1.mbs1.x86_64.rpm 4798a7521e07d53f248e8c0404d3099a mbs1/x86_64/apache-mpm-prefork-2.2.25-1.mbs1.x86_64.rpm 941316dc3caf19922c8c709a39a0748c mbs1/x86_64/apache-mpm-worker-2.2.25-1.mbs1.x86_64.rpm 0f9b2c8659bb1a6d42b97baa0a4588e1 mbs1/x86_64/apache-source-2.2.25-1.mbs1.noarch.rpm 715c2c77ff1f2bbcafca3ada701a7911 mbs1/SRPMS/apache-2.2.25-1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFR3mdymqjQ0CJFipgRAmk4AJ0ZXTC4Wi5fZS6TzCUwUareD2cdhwCg4ucA N+rgmYPGjA3wuPVwNwJtk5M= =7Rn5 -----END PGP SIGNATURE-----
