Subject: new rpm for apache-mod_ssl?

From: Rick Goyette <[email-masked]>
Date: Thu, 07 Mar 2002 10:02:01 -0600

I am running apache-mod_ssl-1.3.20.2.8.4-2, and I like it very much.  It
is a complete package of apache and ssl, and, as it was packaged into a
RedHat rpm,  was easy to install.  However, the recent security advisory
concerning the buffer overflow in mod_ssl  (appended below) demonstrates
my need for an update.  I am unable to locate an rpm which corrects this
problem.   Is there another way to correct this, short of uninstalling
apache-mod_ssl and then installing apache-1.3.23 and
mod_ssl-2.8.7-1.3.23 serarately?

                             INFORMATION BULLETIN
            mod_ssl and Apache_SSL Modules Contain a Buffer Overflow
                      [CERT Vulnerability Note VU#234971]
March 6, 2002 00:00 GMT                                           Number
M-053
____________________________________________________________________________

__
PROBLEM:       There is a remotely exploitable buffer overflow in two
modules
                               that implement the Secure Sockets Layer
(SSL) and Transport
                               Layer Security (TLS) protocol.
PLATFORM:      mod_ssl in all versions prior to 2.8.7-1.3.23.
                                  Apache-SSL in all version prior to
1.3.22+1.4.6.
DAMAGE:        An attacker may be able to execute arbitrary code on the
                                system with the privileges of the ssl
module.
SOLUTION:      Upgrade to mod_ssl 2.8.7 or Apache_SSL 1.3.22+1.46, or
apply
                               the patch provided by your vendor.
____________________________________________________________________________

__
VULNERABILITY  The risk is MEDIUM. To exploit the overflow, the server
must be
ASSESSMENT:    configured to allow client certificates, and an attacker
must
               obtain a carefully crafted client certificate that has
been
               signed by a Certificate Authority (CA) which is trusted
by the server.

--
R. J. Goyette
Argonne National Laboratory
[email-masked]

http://www.pns.anl.gov

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Andrew Lietzow" <[email-masked]>
Date: Thu, 7 Mar 2002 11:59:22 -0600

Dear R. J. Goyette at Argonne National Laboratory,

Just a FYI.  I went to your web site at http://zuul.pns.anl.gov/security/
and clicked on the four Links under Destinations.  Nothing happens.  No
propellers; no hour glass; no meter filling up on the browser-wowser.  Is it
possible that I have something hosed up on my end or are you intending that
these links be that secure?

Now, for my main question, about your posted CERT RISK statement, to wit:
-------------
RE:>> VULNERABILITY ASSESSMENT:  The risk is MEDIUM. To exploit the
overflow, the server must be configured to allow client certificates, and an
attacker must obtain a carefully crafted client certificate that has been
signed by a Certificate Authority (CA) which is trusted by the server.
-------------
Recently, I miraculously got mod_ssl working with apache in something less
than a day (with the secure server being hosted by a new second server which
was my first experience installing SuSE Linux).  I thought that to be
something just short of a miracle, considering the level of investment that
was made.  And, I have not even scratched the scratch of what is available
under the hood for additional features with mod_ssl.

However, just prior to this successful effort, I spent the better part of
two days figuring out why I could not telnet or ftp to one of my servers,
only to discover that it was because my firewall was so tight that it
wouldn't let telnet or ftp packets through.

I know that viruses, and those who continue to manufacture them, are at an
all time high.  And, I know that Governor Tom Rich and the Homeland Security
folks need to have a big chunk of their budget devoted to catching these
rascals; and then for the snacks and sandwiches required to feed the large
crowds that will gather at various sites around the country to see these
scoundrels hanged...

Yet in light of this reality, is the above statement of risk informing
smaller web server providers that we need to pay great homage to this
seemingly remote possibility, or risk being forever in a state of turmoil?
I really want to learn more about mod_ssl on this list, but if this is
necessary, then ...

Please open my eyes...

Andrew Lietzow
The ACL Group, Inc.