Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2009.0353 -- [Win][UNIX/Linux] mod_perl: Execute Arbitrary Code 14 April 2009 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: mod_perl Publisher: Mandriva Operating System: Mandriva UNIX variants (UNIX, Linux, OSX) Windows Impact: Execute Arbitrary Code/Commands Access: Remote/Unauthenticated CVE Names: CVE-2009-0796 Comment: This advisory references vulnerabilities in products which run on platforms other than Mandriva. It is recommended that administrators running mod_perl check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:091 http://www.mandriva.com/security/ _______________________________________________________________________ Package : mod_perl Date : April 12, 2009 Affected: 2008.1, 2009.0, Corporate 3.0, Corporate 4.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in mod_perl v1.x and v2.x: Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI (CVE-2009-0796). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0796 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.1: 1d205036b1dbd484e9024fa0e2dc1fe1 2008.1/i586/apache-mod_perl-2.0.4-1.1mdv2008.1.i586.rpm 942265eb68c831addfa004033cbeb723 2008.1/i586/apache-mod_perl-devel-2.0.4-1.1mdv2008.1.i586.rpm 975f3c6f533577713c15f37da0495f58 2008.1/SRPMS/apache-mod_perl-2.0.4-1.1mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: 668d1aea2e07c7999afc22e05a25d1dd 2008.1/x86_64/apache-mod_perl-2.0.4-1.1mdv2008.1.x86_64.rpm 7025760de956d57bb70fa4d8e82cb398 2008.1/x86_64/apache-mod_perl-devel-2.0.4-1.1mdv2008.1.x86_64.rpm 975f3c6f533577713c15f37da0495f58 2008.1/SRPMS/apache-mod_perl-2.0.4-1.1mdv2008.1.src.rpm Mandriva Linux 2009.0: 01398435bd1a204c7bf6bc02fd6dc5b7 2009.0/i586/apache-mod_perl-2.0.4-2.1mdv2009.0.i586.rpm 40d0d1b7f617eeae983b9c02136823ef 2009.0/i586/apache-mod_perl-devel-2.0.4-2.1mdv2009.0.i586.rpm f7dac6aa0996078878dc2bf3923a27f0 2009.0/SRPMS/apache-mod_perl-2.0.4-2.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 0e24b8d807bba4b117bce2c9c86955e0 2009.0/x86_64/apache-mod_perl-2.0.4-2.1mdv2009.0.x86_64.rpm e3fee0b48c8ed0b7e7202cc38e554edf 2009.0/x86_64/apache-mod_perl-devel-2.0.4-2.1mdv2009.0.x86_64.rpm f7dac6aa0996078878dc2bf3923a27f0 2009.0/SRPMS/apache-mod_perl-2.0.4-2.1mdv2009.0.src.rpm Corporate 3.0: 14b008d79f846af06fbf12129cdaa712 corporate/3.0/i586/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.i586.rpm 718172be629f96bd60dea087d38ab32a corporate/3.0/i586/apache2-mod_perl-devel-2.0.48_1.99_11-3.2.C30mdk.i586.rpm 8455048db64d2612bfe98b42fc2264ec corporate/3.0/i586/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.i586.rpm 142cbfb23709370eb4a1e772c2ccd2dc corporate/3.0/i586/HTML-Embperl-1.3.29_1.3.6-3.3.C30mdk.i586.rpm 623ee8abce645fe5559113b20fbd0b85 corporate/3.0/i586/mod_perl-common-1.3.29_1.29-3.3.C30mdk.i586.rpm 0ba166ad17f61307f96488a4ed32b63f corporate/3.0/i586/mod_perl-devel-1.3.29_1.29-3.3.C30mdk.i586.rpm b851faef67b39398298a45036eca7a7a corporate/3.0/SRPMS/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.src.rpm 0cd8b877c25b480297c538ecb7bbc452 corporate/3.0/SRPMS/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.src.rpm Corporate 3.0/X86_64: aa391fc09b4218fa9828c74811429d0b corporate/3.0/x86_64/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.x86_64.rpm de6a746e8ef88144a2dded6699bc3e2f corporate/3.0/x86_64/apache2-mod_perl-devel-2.0.48_1.99_11-3.2.C30mdk.x86_64.rpm 73f77bd0290ca076407ca46a56a9ff1f corporate/3.0/x86_64/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.x86_64.rpm 192ff89d1e34960b3dbaf70e74017ebb corporate/3.0/x86_64/HTML-Embperl-1.3.29_1.3.6-3.3.C30mdk.x86_64.rpm 7290a44b466c12f5615e8fb8eac28f84 corporate/3.0/x86_64/mod_perl-common-1.3.29_1.29-3.3.C30mdk.x86_64.rpm 8fa64c7ff1713505a62ead1624ceacd1 corporate/3.0/x86_64/mod_perl-devel-1.3.29_1.29-3.3.C30mdk.x86_64.rpm b851faef67b39398298a45036eca7a7a corporate/3.0/SRPMS/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.src.rpm 0cd8b877c25b480297c538ecb7bbc452 corporate/3.0/SRPMS/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.src.rpm Corporate 4.0: ca5870b0c9804b047f5029644c06e863 corporate/4.0/i586/apache-mod_perl-2.0.2-8.2.20060mlcs4.i586.rpm d34ca151d1234922b01aef484bb4358c corporate/4.0/i586/apache-mod_perl-devel-2.0.2-8.2.20060mlcs4.i586.rpm e94cd2da56d1ad8fe1bd045f8e4a0377 corporate/4.0/SRPMS/apache-mod_perl-2.0.2-8.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 1710aeba439a3de8701c37c8aafc03db corporate/4.0/x86_64/apache-mod_perl-2.0.2-8.2.20060mlcs4.x86_64.rpm 41438909b8155a8fd55f1826351aded0 corporate/4.0/x86_64/apache-mod_perl-devel-2.0.2-8.2.20060mlcs4.x86_64.rpm e94cd2da56d1ad8fe1bd045f8e4a0377 corporate/4.0/SRPMS/apache-mod_perl-2.0.2-8.2.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFJ4bCOmqjQ0CJFipgRAmyTAKCLsSQhGpta3bB3LwZEPHQK5M7cugCdH9+F UbapeDmrzrK/aZYQ61d4AJs= =JZyQ - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iD8DBQFJ5CsoNVH5XJJInbgRAm4eAJ0VZPYstckTzPXabBuFAkqO6AVrggCfcr4v UHsV9zfqGGX88x/+iYUGT7c= =YxxF -----END PGP SIGNATURE-----