Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:23299
HistoryMar 01, 2010 - 12:00 a.m.

[ MDVSA-2010:050 ] apache-mod_security

2010-03-0100:00:00
vulners.com
17

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2010:050
http://www.mandriva.com/security/


Package : apache-mod_security
Date : February 26, 2010
Affected: Corporate 4.0, Enterprise Server 5.0


Problem Description:

This release fixes several important issues to help prevent a detection
bypass and denial of service attacks against ModSecurity. Quite a few
small but notable bugs were fixed. The latest Core Ruleset (2.0.5)
is included.

This update provides mod_security 2.5.12, which is not vulnerable to
these issues.


References:

http://www.openwall.com/lists/oss-security/2010/02/10/2


Updated Packages:

Corporate 4.0:
060b65ea36f76addd895826357b2a5b6 corporate/4.0/i586/apache-mod_security-2.5.12-0.1.20060mlcs4.i586.rpm
6adf7cc4ab70afa5bde905d216016c2d corporate/4.0/i586/mlogc-2.5.12-0.1.20060mlcs4.i586.rpm
643bbdd7992f90d73701b147dacfdb11 corporate/4.0/SRPMS/apache-mod_security-2.5.12-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
ae250cdf3ad5a26412060761a5f9b693 corporate/4.0/x86_64/apache-mod_security-2.5.12-0.1.20060mlcs4.x86_64.rpm
8cd16b4b4169fdc674172f528a8e300b corporate/4.0/x86_64/mlogc-2.5.12-0.1.20060mlcs4.x86_64.rpm
643bbdd7992f90d73701b147dacfdb11 corporate/4.0/SRPMS/apache-mod_security-2.5.12-0.1.20060mlcs4.src.rpm

Mandriva Enterprise Server 5:
5d075d31c949990342c25e1ebfd1c3d5 mes5/i586/apache-mod_security-2.5.12-0.1mdvmes5.i586.rpm
bafe8e09662e57e35cc97852fc0594f2 mes5/i586/mlogc-2.5.12-0.1mdvmes5.i586.rpm
6a81014ccb3844947f4bace2435f51d2 mes5/SRPMS/apache-mod_security-2.5.12-0.1mdvmes5.src.rpm

Mandriva Enterprise Server 5/X86_64:
0da28a88ecf44589784c6ab2f090ae13 mes5/x86_64/apache-mod_security-2.5.12-0.1mdvmes5.x86_64.rpm
101288df2a94f66354b6a4bfdc1b003f mes5/x86_64/mlogc-2.5.12-0.1mdvmes5.x86_64.rpm
6a81014ccb3844947f4bace2435f51d2 mes5/SRPMS/apache-mod_security-2.5.12-0.1mdvmes5.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLh6BtmqjQ0CJFipgRAv9aAKCfy716u8EirDEb3jjkctM3LqOGjgCgjkGf
o3QYUYUVsYNcAkevijpGr7I=
=hyz0
-----END PGP SIGNATURE-----