Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
|
|
SecurityTracker Alert ID: 1008828
|
|
CVE Reference: CAN-2004-0096
(Links to External Site)
|
Updated: Feb 25 2004
|
Original Entry Date: Jan 23 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2.7.9
|
Description: A vulnerability was reported in Apache mod_python. A remote user can cause the Apache server to crash.
It is reported that a remote user can issue a specific query string to be processed by mod_python to cause the Apache httpd process
to crash.
The vendor indicates that this flaw was previously reported and was to have been fixed by version 2.7.9, but was not
properly fixed in that version.
[Editor's note: The previously reported flaw was discussed in Alert ID 1008335 and CVE number
CAN-2003-0973 in November 2003.]
|
Impact: A remote user can cause the Apache web service to crash.
|
Solution: The vendor has issued a fixed version (2.7.10) and recommends that users of mod_python 2.7.9 or earlier upgrade to 2.7.10 as soon
as possible, available at:
http://httpd.apache.org/modules/python-download.cgi
The vendor indicates that users of mod_python
3.0.4 do not need to do anything.
|
Vendor URL: www.modpython.org/ (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: "Gregory (Grisha) Trubetskoy" <grisha@apache.org>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 22 Jan 2004 19:14:15 -0500 (EST)
From: "Gregory (Grisha) Trubetskoy" <grisha@apache.org>
Subject: [ANNOUNCE] Mod_python 2.7.10
|
The Apache Software Foundation and The Apache HTTP Server Project are
pleased to announce the release of version 2.7.10 of mod_python.
This release addresses a vulnerability in mod_python 2.7.9 whereby a
specific query string processed by mod_python would cause the httpd
process to crash.
The previously released version 2.7.9 was supposed to correct this issue,
but is still vulnerable.
There are no other changes or improvements from the previous version in
this release.
If you are currently using mod_python 2.7.9 or earlier, it is highly
recommended that you upgrade to 2.7.10 as soon as possible.
If you are using mod_python 3.0.4, no action is necessary.
Mod_python is available for download from:
http://httpd.apache.org/modules/python-download.cgi
For more information about mod_python visit
http://www.modpython.org/
Regards,
Grisha Trubetskoy
---------------------------------------------------------------------
To unsubscribe, e-mail: announce-unsubscribe@httpd.apache.org
For additional commands, e-mail: announce-help@httpd.apache.org
|
|
