[ MDVSA-2013:193 ] apache

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mandriva Linux Security Advisory MDVSA-2013:193
http://www.mandriva.com/en/support/security/

Package : apache
Date : July 11, 2013
Affected: Business Server 1.0, Enterprise Server 5.0

Problem Description:

A vulnerability has been found and corrected in apache (ASF HTTPD):

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly
determine whether DAV is enabled for a URI, which allows remote
attackers to cause a denial of service (segmentation fault) via a
MERGE request in which the URI is configured for handling by the
mod_dav_svn module, but a certain href attribute in XML data refers
to a non-DAV URI (CVE-2013-1896).

The updated packages have been upgraded to the latest 2.2.25 version
which is not vulnerable to this issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1896
http://httpd.apache.org/security/vulnerabilities_22.html
http://www.apache.org/dist/httpd/CHANGES_2.2.25

Updated Packages:

Mandriva Enterprise Server 5:
74428d38a11260e9c8e66c2096cc1815 mes5/i586/apache-base-2.2.25-0.1mdvmes5.2.i586.rpm
ef99b13e24656d5d2fdf6bacfccf4e71 mes5/i586/apache-conf-2.2.25-0.1mdvmes5.2.i586.rpm
6d31e1cf0b374d0c03a254ed57a1f467 mes5/i586/apache-devel-2.2.25-0.1mdvmes5.2.i586.rpm
e7de8b165bb03db079efd2a3a37f537e mes5/i586/apache-doc-2.2.25-0.1mdvmes5.2.i586.rpm
710d058cccac3de097e590e6dd90944a mes5/i586/apache-htcacheclean-2.2.25-0.1mdvmes5.2.i586.rpm
0d04268ef8d9384e7ea0ed1e1813ed7a mes5/i586/apache-mod_authn_dbd-2.2.25-0.1mdvmes5.2.i586.rpm
efe738920fa67624eb8e5dc9371ebce5 mes5/i586/apache-mod_cache-2.2.25-0.1mdvmes5.2.i586.rpm
a27ce4545c26c09902182f460686c6b9 mes5/i586/apache-mod_dav-2.2.25-0.1mdvmes5.2.i586.rpm
47ef6587bdd08ca712f09711ca5aebe3 mes5/i586/apache-mod_dbd-2.2.25-0.1mdvmes5.2.i586.rpm
debd225f26997295f9f134b5ef03eaf1 mes5/i586/apache-mod_deflate-2.2.25-0.1mdvmes5.2.i586.rpm
5d4feab915dd178652dda909fe4d45f4 mes5/i586/apache-mod_disk_cache-2.2.25-0.1mdvmes5.2.i586.rpm
c1791f4ef3c793a5c9df4b03cfea2407 mes5/i586/apache-mod_file_cache-2.2.25-0.1mdvmes5.2.i586.rpm
e43f45f40c594be8cb24a9a7da6d170a mes5/i586/apache-mod_ldap-2.2.25-0.1mdvmes5.2.i586.rpm
4834d67363fa96e13a46f7bd00ce8493 mes5/i586/apache-mod_mem_cache-2.2.25-0.1mdvmes5.2.i586.rpm
5ef573a28241172e907a8917f0b181c0 mes5/i586/apache-mod_proxy-2.2.25-0.1mdvmes5.2.i586.rpm
6010f92f994a81cb63f3f4488aa2da43 mes5/i586/apache-mod_proxy_ajp-2.2.25-0.1mdvmes5.2.i586.rpm
33d3d29122153699b90d81aceb2e21fa mes5/i586/apache-mod_proxy_scgi-2.2.25-0.1mdvmes5.2.i586.rpm
257c1cf46f1b37e9becd8646a001ea4e mes5/i586/apache-mod_reqtimeout-2.2.25-0.1mdvmes5.2.i586.rpm
9111ebcd2c948cafcda80c699dfe0168 mes5/i586/apache-mod_ssl-2.2.25-0.1mdvmes5.2.i586.rpm
9cc61bbe23ae03bce08858593e57fc66 mes5/i586/apache-mod_suexec-2.2.25-0.1mdvmes5.2.i586.rpm
cedf1df8facd3f78b77f18fd90c634fc mes5/i586/apache-modules-2.2.25-0.1mdvmes5.2.i586.rpm
a7b8090e403577f821f79738e008133b mes5/i586/apache-mod_userdir-2.2.25-0.1mdvmes5.2.i586.rpm
d7154dc483edc17f2a06b14ec927a6a5 mes5/i586/apache-mpm-event-2.2.25-0.1mdvmes5.2.i586.rpm
b6e2637d39fbe9af4712cc133bbd8782 mes5/i586/apache-mpm-itk-2.2.25-0.1mdvmes5.2.i586.rpm
9aae9446b9ed93f9e86fac2f0f56f18f mes5/i586/apache-mpm-peruser-2.2.25-0.1mdvmes5.2.i586.rpm
4942fe06be63a4be7960fe877f4742c0 mes5/i586/apache-mpm-prefork-2.2.25-0.1mdvmes5.2.i586.rpm
7bc44bdb05e448b0e4ce9e9c22cc2913 mes5/i586/apache-mpm-worker-2.2.25-0.1mdvmes5.2.i586.rpm
88d865382f4783f7bb948f3af029b10b mes5/i586/apache-source-2.2.25-0.1mdvmes5.2.i586.rpm
528dfc52f44fb7bf0fec6200f028063d mes5/SRPMS/apache-2.2.25-0.1mdvmes5.2.src.rpm
49b8eee01f15355b1c2f4f974776f9c2 mes5/SRPMS/apache-conf-2.2.25-0.1mdvmes5.2.src.rpm
6803e25ee43375a8302a89426d01382b mes5/SRPMS/apache-mod_suexec-2.2.25-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
6452960bec31ffd774ebee36bc54bf36 mes5/x86_64/apache-base-2.2.25-0.1mdvmes5.2.x86_64.rpm
59d55a174a4d828e3f26de393fc6767c mes5/x86_64/apache-conf-2.2.25-0.1mdvmes5.2.x86_64.rpm
52f4d81bc1e5bf036f7f976d35870609 mes5/x86_64/apache-devel-2.2.25-0.1mdvmes5.2.x86_64.rpm
d5095a0a9638039a2219582658ea2829 mes5/x86_64/apache-doc-2.2.25-0.1mdvmes5.2.x86_64.rpm
70b872c6b6a8240ec394d2600a38a6d7 mes5/x86_64/apache-htcacheclean-2.2.25-0.1mdvmes5.2.x86_64.rpm
bcf68f1bf2b3d3795f838b024a9d768e mes5/x86_64/apache-mod_authn_dbd-2.2.25-0.1mdvmes5.2.x86_64.rpm
e02bae63b3250b5151ce439f91e11856 mes5/x86_64/apache-mod_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm
e78eb3a2cba8651eb614f8fde497d137 mes5/x86_64/apache-mod_dav-2.2.25-0.1mdvmes5.2.x86_64.rpm
2a5180f9e243c6469ca8738c6873d0ea mes5/x86_64/apache-mod_dbd-2.2.25-0.1mdvmes5.2.x86_64.rpm
4cf24fbc6ed54f0df842cdc16ca1c7d2 mes5/x86_64/apache-mod_deflate-2.2.25-0.1mdvmes5.2.x86_64.rpm
ca011efa4a592be9ce87068bba01f505 mes5/x86_64/apache-mod_disk_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm
ce137ce1a31b9b2da83042bb2c24935f mes5/x86_64/apache-mod_file_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm
931c6eaa5627b2c466cd959dc7e61300 mes5/x86_64/apache-mod_ldap-2.2.25-0.1mdvmes5.2.x86_64.rpm
4902fed22c7c383134731cf3a4924e92 mes5/x86_64/apache-mod_mem_cache-2.2.25-0.1mdvmes5.2.x86_64.rpm
74e556135f5b214dd3c6902aafef7c27 mes5/x86_64/apache-mod_proxy-2.2.25-0.1mdvmes5.2.x86_64.rpm
18aee4012faebb7a15ee2ce445bf0b08 mes5/x86_64/apache-mod_proxy_ajp-2.2.25-0.1mdvmes5.2.x86_64.rpm
38e7260f51e459307946a8f67bde2e8b mes5/x86_64/apache-mod_proxy_scgi-2.2.25-0.1mdvmes5.2.x86_64.rpm
444468976bcb21f539bac57a714272b9 mes5/x86_64/apache-mod_reqtimeout-2.2.25-0.1mdvmes5.2.x86_64.rpm
630424ff1d18e7bb6a7063e6dfd69c45 mes5/x86_64/apache-mod_ssl-2.2.25-0.1mdvmes5.2.x86_64.rpm
a2ac6c44d134b106bec3506533cb534b mes5/x86_64/apache-mod_suexec-2.2.25-0.1mdvmes5.2.x86_64.rpm
328fa7cbd902b9814debeb8220883fe6 mes5/x86_64/apache-modules-2.2.25-0.1mdvmes5.2.x86_64.rpm
8a417231e1941ddb77402f4c61d24a86 mes5/x86_64/apache-mod_userdir-2.2.25-0.1mdvmes5.2.x86_64.rpm
0018ae820accd9721850bc5137904f90 mes5/x86_64/apache-mpm-event-2.2.25-0.1mdvmes5.2.x86_64.rpm
60b07648ddc2604dbc29774221549c02 mes5/x86_64/apache-mpm-itk-2.2.25-0.1mdvmes5.2.x86_64.rpm
dfb8120702f08677ac0cfbf350626a33 mes5/x86_64/apache-mpm-peruser-2.2.25-0.1mdvmes5.2.x86_64.rpm
96e0576c0c276915343720cc316d305a mes5/x86_64/apache-mpm-prefork-2.2.25-0.1mdvmes5.2.x86_64.rpm
7ffeaffc2e86b21b118ee51bfea38d26 mes5/x86_64/apache-mpm-worker-2.2.25-0.1mdvmes5.2.x86_64.rpm
cc4fb93cac638bcbda72e068f399b1af mes5/x86_64/apache-source-2.2.25-0.1mdvmes5.2.x86_64.rpm
528dfc52f44fb7bf0fec6200f028063d mes5/SRPMS/apache-2.2.25-0.1mdvmes5.2.src.rpm
49b8eee01f15355b1c2f4f974776f9c2 mes5/SRPMS/apache-conf-2.2.25-0.1mdvmes5.2.src.rpm
6803e25ee43375a8302a89426d01382b mes5/SRPMS/apache-mod_suexec-2.2.25-0.1mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
90e479d61bbe4c07b06cca031b74e9c5 mbs1/x86_64/apache-2.2.25-1.mbs1.x86_64.rpm
c446c45054157bc57b468d1c7f1ee804 mbs1/x86_64/apache-devel-2.2.25-1.mbs1.x86_64.rpm
76bb0fb4a59c0370aaec176dea66f693 mbs1/x86_64/apache-doc-2.2.25-1.mbs1.noarch.rpm
3def45aac7e9983ca2b23bd1ce0ed575 mbs1/x86_64/apache-htcacheclean-2.2.25-1.mbs1.x86_64.rpm
193c55dd324990043d411b2e06532954 mbs1/x86_64/apache-mod_authn_dbd-2.2.25-1.mbs1.x86_64.rpm
f4ea9e3ea46bb8ce16bbc9dc1e31e7a6 mbs1/x86_64/apache-mod_cache-2.2.25-1.mbs1.x86_64.rpm
14c198a1e0bfebbbb7dcf2209a52067b mbs1/x86_64/apache-mod_dav-2.2.25-1.mbs1.x86_64.rpm
a3728918d726719cb1b93614b3c06e5f mbs1/x86_64/apache-mod_dbd-2.2.25-1.mbs1.x86_64.rpm
68fa63361621f237afbe5af065827ebb mbs1/x86_64/apache-mod_deflate-2.2.25-1.mbs1.x86_64.rpm
db2cc66ba253dbdbb11c5cea06fab9f5 mbs1/x86_64/apache-mod_disk_cache-2.2.25-1.mbs1.x86_64.rpm
a4e22cc39938eb6061555e532e65c446 mbs1/x86_64/apache-mod_file_cache-2.2.25-1.mbs1.x86_64.rpm
fe86db4e6deed7f917b5aea72fe70627 mbs1/x86_64/apache-mod_ldap-2.2.25-1.mbs1.x86_64.rpm
8c61c24ca7a5ac76697c92cfebde8a70 mbs1/x86_64/apache-mod_mem_cache-2.2.25-1.mbs1.x86_64.rpm
011b2a819656d5a550e161ef363df608 mbs1/x86_64/apache-mod_proxy-2.2.25-1.mbs1.x86_64.rpm
c2201afe28c59ed0ec3b016e5be0ef77 mbs1/x86_64/apache-mod_proxy_ajp-2.2.25-1.mbs1.x86_64.rpm
a8883c21f216a84bbc1cd218c34669c4 mbs1/x86_64/apache-mod_proxy_scgi-2.2.25-1.mbs1.x86_64.rpm
36b80d68aed432fd933f2fcdbaf805f7 mbs1/x86_64/apache-mod_reqtimeout-2.2.25-1.mbs1.x86_64.rpm
58f1b017f4729b6d0a72a04fb0f15ba5 mbs1/x86_64/apache-mod_ssl-2.2.25-1.mbs1.x86_64.rpm
e10760da2d3f96d5bf10e365663ca4e5 mbs1/x86_64/apache-mod_suexec-2.2.25-1.mbs1.x86_64.rpm
31ce2edb42bdac89b1fc850bec9779a1 mbs1/x86_64/apache-mod_userdir-2.2.25-1.mbs1.x86_64.rpm
2ee1edc95d78126b46ca33bda2f4087c mbs1/x86_64/apache-mpm-event-2.2.25-1.mbs1.x86_64.rpm
72db5917a6cdcceaa152baceb37c002e mbs1/x86_64/apache-mpm-itk-2.2.25-1.mbs1.x86_64.rpm
fd41ef0ca72ed6d761d4a2d1e0dd588b mbs1/x86_64/apache-mpm-peruser-2.2.25-1.mbs1.x86_64.rpm
4798a7521e07d53f248e8c0404d3099a mbs1/x86_64/apache-mpm-prefork-2.2.25-1.mbs1.x86_64.rpm
941316dc3caf19922c8c709a39a0748c mbs1/x86_64/apache-mpm-worker-2.2.25-1.mbs1.x86_64.rpm
0f9b2c8659bb1a6d42b97baa0a4588e1 mbs1/x86_64/apache-source-2.2.25-1.mbs1.noarch.rpm
715c2c77ff1f2bbcafca3ada701a7911 mbs1/SRPMS/apache-2.2.25-1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFR3mdymqjQ0CJFipgRAmk4AJ0ZXTC4Wi5fZS6TzCUwUareD2cdhwCg4ucA
N+rgmYPGjA3wuPVwNwJtk5M=
=7Rn5
-----END PGP SIGNATURE-----