U radu programskog paketa mod_auth_mysql, na operacijskim sustavima Fedora 13 i 14, uočen je sigurnosni nedostatak. Riječ je o modulu koji sadrži dodatak za Apache HTTP poslužitelj te omogućuje provedbu autentikacije. Nedostatak proizlazi iz načina na koji mod_auth_mysql obrađuje određene znakovne nizove kodirane s više okteta. Udaljeni napadač može ovaj nedostatak iskoristiti za ubacivanje proizvoljnih SQL naredbi u zahtjev za prijavu na ranjivu aplikaciju. Proizvođač je izdao ispravljene inačice koje otklanjaju spomenuti propust te se svim korisnicima savjetuje njihova instalacija.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0114
2011-01-04 20:16:01
--------------------------------------------------------------------------------
Name : mod_auth_mysql
Product : Fedora 13
Version : 3.0.0
Release : 12.fc13
URL : http://modauthmysql.sourceforge.net/
Summary : Basic authentication for the Apache web server using a MySQL
database
Description :
mod_auth_mysql can be used to limit access to documents served by a
web server by checking data in a MySQL database.
--------------------------------------------------------------------------------
Update Information:
This update fixes a security issue in mod_auth_mysql.
A flaw was found in the way mod_auth_mysql escaped certain
multibyte-encoded strings. If mod_auth_mysql was configured to use a multibyte
character set that allowed a backslash ("") as part of the character encodings,
a remote attacker could inject arbitrary SQL commands into a login request.
(CVE-2008-2384)
Note: This flaw only affected non-default installations where
AuthMySQLCharacterSet is configured to use one of the affected multibyte
character sets. Installations that did not use the AuthMySQLCharacterSet
configuration option were not vulnerable to this flaw.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 16 2010 Joe Orton <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1:3.0.0-12
- add security fix for CVE-2008-2384 (#663617)
* Sat Jun 19 2010 Joe Orton <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1:3.0.0-11
- less noise for httpd-mmn BR; package the LICENSE (#605950)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #480238 - CVE-2008-2384 mod_auth_mysql: character encoding SQL
injection flaw
https://bugzilla.redhat.com/show_bug.cgi?id=480238
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mod_auth_mysql' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-0100
2011-01-04 20:15:34
--------------------------------------------------------------------------------
Name : mod_auth_mysql
Product : Fedora 14
Version : 3.0.0
Release : 12.fc14
URL : http://modauthmysql.sourceforge.net/
Summary : Basic authentication for the Apache web server using a MySQL
database
Description :
mod_auth_mysql can be used to limit access to documents served by a
web server by checking data in a MySQL database.
--------------------------------------------------------------------------------
Update Information:
This update fixes a security issue in mod_auth_mysql.
A flaw was found in the way mod_auth_mysql escaped certain
multibyte-encoded strings. If mod_auth_mysql was configured to use a multibyte
character set that allowed a backslash ("") as part of the character encodings,
a remote attacker could inject arbitrary SQL commands into a login request.
(CVE-2008-2384)
Note: This flaw only affected non-default installations where
AuthMySQLCharacterSet is configured to use one of the affected multibyte
character sets. Installations that did not use the AuthMySQLCharacterSet
configuration option were not vulnerable to this flaw.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 16 2010 Joe Orton <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1:3.0.0-12
- add security fix for CVE-2008-2384 (#663617)
* Sat Jun 19 2010 Joe Orton <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1:3.0.0-11
- less noise for httpd-mmn BR; package the LICENSE (#605950)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #480238 - CVE-2008-2384 mod_auth_mysql: character encoding SQL
injection flaw
https://bugzilla.redhat.com/show_bug.cgi?id=480238
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update mod_auth_mysql' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke