Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2009.1536 A vulnerability was discovered and corrected in apache-conf 17 November 2009 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: apache-conf Publisher: Mandriva Operating System: Mandriva Linux UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Cross-site Scripting -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2009-2823 Reference: ESB-2009.1500 Original Bulletin: http://www.mandriva.com/en/security/advisories?name=MDVSA-2009:300 Comment: This advisory references vulnerabilities in products which run on platforms other than Mandriva. It is recommended that administrators running apache-conf check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:300 http://www.mandriva.com/security/ _______________________________________________________________________ Package : apache-conf Date : November 15, 2009 Affected: 2009.0, 2009.1, 2010.0, Corporate 3.0, Corporate 4.0, Enterprise Server 5.0, Multi Network Firewall 2.0 _______________________________________________________________________ Problem Description: A vulnerability was discovered and corrected in apache-conf: The Apache HTTP Server enables the HTTP TRACE method per default which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified web client software (CVE-2009-2823). This update provides a solution to this vulnerability. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2823 http://www.kb.cert.org/vuls/id/867593 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: a1a93cc99dce060dc70c9b84bc77fe73 2009.0/i586/apache-conf-2.2.9-2.1mdv2009.0.i586.rpm 8e681fa0418a0951aa899d48033e00c0 2009.0/SRPMS/apache-conf-2.2.9-2.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 34765a6938fb58a84e94469f6955aa27 2009.0/x86_64/apache-conf-2.2.9-2.1mdv2009.0.x86_64.rpm 8e681fa0418a0951aa899d48033e00c0 2009.0/SRPMS/apache-conf-2.2.9-2.1mdv2009.0.src.rpm Mandriva Linux 2009.1: 6666715aaf3f95fb93d408e7a2e5f7a8 2009.1/i586/apache-conf-2.2.11-5.1mdv2009.1.i586.rpm d3dbacf5618880138f550a549ebb0c7f 2009.1/i586/apache-conf-2.2.9-2.1mdv2009.1.i586.rpm 05fe57eecfa55b7eb564cb4d69bd66c6 2009.1/SRPMS/apache-conf-2.2.11-5.1mdv2009.1.src.rpm 968b77fbb38a4fcc51ae236121a8cd07 2009.1/SRPMS/apache-conf-2.2.9-2.1mdv2009.0.src.rpm Mandriva Linux 2009.1/X86_64: 07c8d486e9cf3d2ccbbc008540475341 2009.1/x86_64/apache-conf-2.2.11-5.1mdv2009.1.x86_64.rpm de765ed36181f354d6d9a85a9a797658 2009.1/x86_64/apache-conf-2.2.9-2.1mdv2009.1.x86_64.rpm 05fe57eecfa55b7eb564cb4d69bd66c6 2009.1/SRPMS/apache-conf-2.2.11-5.1mdv2009.1.src.rpm 968b77fbb38a4fcc51ae236121a8cd07 2009.1/SRPMS/apache-conf-2.2.9-2.1mdv2009.0.src.rpm Mandriva Linux 2010.0: 95495c9225a5f30240f78721c8b69147 2010.0/i586/apache-conf-2.2.14-1.1mdv2010.0.i586.rpm 2f78caa45aacf9f673cade5630b2c310 2010.0/SRPMS/apache-conf-2.2.14-1.1mdv2010.0.src.rpm Mandriva Linux 2010.0/X86_64: edf8c147eced8445aebd6bc8878ccc8a 2010.0/x86_64/apache-conf-2.2.14-1.1mdv2010.0.x86_64.rpm 2f78caa45aacf9f673cade5630b2c310 2010.0/SRPMS/apache-conf-2.2.14-1.1mdv2010.0.src.rpm Corporate 3.0: 12beea6a8fd2aa124990902511bd3b13 corporate/3.0/i586/apache-conf-2.0.48-4.1.C30mdk.i586.rpm 793ac16880599d98d46d75d18e267590 corporate/3.0/SRPMS/apache-conf-2.0.48-4.1.C30mdk.src.rpm Corporate 3.0/X86_64: 6d3fb3d9a6a13b9af4fabf33e5d19d8a corporate/3.0/x86_64/apache-conf-2.0.48-4.1.C30mdk.x86_64.rpm 793ac16880599d98d46d75d18e267590 corporate/3.0/SRPMS/apache-conf-2.0.48-4.1.C30mdk.src.rpm Corporate 4.0: bff638e13669d04f50efbbdc7659994d corporate/4.0/i586/apache-conf-2.2.3-1.2.20060mlcs4.i586.rpm b25eb9dde45ca05ce6a9e70096d86aab corporate/4.0/SRPMS/apache-conf-2.2.3-1.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 7494f5ebd51e6eb7e1e2f085e65df3e5 corporate/4.0/x86_64/apache-conf-2.2.3-1.2.20060mlcs4.x86_64.rpm b25eb9dde45ca05ce6a9e70096d86aab corporate/4.0/SRPMS/apache-conf-2.2.3-1.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 3ece87a4a682fa9eac5d56731c957528 mes5/i586/apache-conf-2.2.9-2.1mdvmes5.i586.rpm b18d8e392a76d9bc6465caafa834389a mes5/SRPMS/apache-conf-2.2.9-2.1mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: 5e547eccf895fec458827a170679df58 mes5/x86_64/apache-conf-2.2.9-2.1mdvmes5.x86_64.rpm b18d8e392a76d9bc6465caafa834389a mes5/SRPMS/apache-conf-2.2.9-2.1mdvmes5.src.rpm Multi Network Firewall 2.0: 26351a3ea2d859fe11373e4763e4e847 mnf/2.0/i586/apache-conf-2.0.48-4.1.C30mdk.i586.rpm 0bb783ca29a5a8f698eae6b3a759156c mnf/2.0/SRPMS/apache-conf-2.0.48-4.1.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLABm1mqjQ0CJFipgRAkHMAKCKmjzWyYNNFUxA0XIzUZKKzjIwGgCdHwa3 F7D9Egyb9w/z4KqZDNzKMrc= =Isyb - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iD8DBQFLAhCdNVH5XJJInbgRAnjXAJ9fOnVRy5ZftZWhjE89riyeOTaXtQCgg80z mt39yuu0dsEQnWojJRNQzvc= =epHN -----END PGP SIGNATURE-----