Subject: RE: [ANNOUNCE] mod_ssl 2.8.12

From: "Courtin Bert" <[email-masked]>
Date: Wed, 23 Oct 2002 11:32:53 +0200

Hi list,

is there any information available regarding the mentioned
potential Cross-Side-Scripting bug?
(Any CERT/CC Advisory CA-xxxxx, BUGTRAQ-Messages etc...)

Thanks in advance & kind regards,

B. Courtin

> -----Original Message-----
> From: Ralf S. Engelschall [mailto:[email-masked]]
> Sent: Wednesday, October 23, 2002 11:15 AM
> To: [email-masked]; [email-masked]
> Subject: [ANNOUNCE] mod_ssl 2.8.12
> 
> 
> Because of a found Cross-Side-Scripting (XSS) bug in mod_ssl, 
> the fixed
> maintainance version mod_ssl 2.8.12 is available for use with Apache
> 1.3.27.
> 
> http://www.modssl.org/source/
>  ftp://ftp.modssl.org/source/
>                                        Ralf S. Engelschall
>                                        [email-masked]
>                                        www.engelschall.com
> 
>   Changes with mod_ssl 2.8.12 (04-Oct-2002 to 23-Oct-2002)
> 
>    *) Fixed potential Cross-Site-Scripting bug.
> 
>    *) Allow also 8192 bytes of shared memory data size.
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Joe Orton <[email-masked]>
Date: Wed, 23 Oct 2002 10:51:58 +0100

> (Any CERT/CC Advisory CA-xxxxx, BUGTRAQ-Messages etc...)

Hi, here are the details:

Versions of mod_ssl older than 2.8.12 suffer from a cross-site-
scripting bug: mod_ssl will send the server name unescaped in the
response to an HTTP request on an SSL port.  This issue has been
assigned CVE CAN-2002-1157.

Like the other recent Apache XSS bugs, this only affects servers using
a combination of "UseCanonicalName off" (not the default in 1.3) and
wildcard DNS.  Apache 2.0/mod_ssl is not vulnerable since it already
escapes this HTML.

Regards,

joe

-- 
Joe Orton, Red Hat Europe, Stronghold Engineering
http://stronghold.redhat.com/
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]