OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2002.010
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2002.010
Advisory Published:      2009-01-07 05:15 UTC

Issue Id (internal):     OpenPKG-SI-20021023.01
Issue First Created:     2002-10-23
Issue Last Modified:     2006-11-28
Issue Revision:          06


Subject Name:            Apache mod_ssl
Subject Summary:         Apache HTTP Server
Subject Home:            http://www.modssl.org/
Subject Versions:        * <= 1.3.27

Vulnerability Id:        CVE-2002-0840
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           identity fraud

Description:
    Joe Orton <jorton@redhat.com> discovered a cross site scripting (XSS)
    bug [3] in mod_ssl [1], the SSL/TLS component for the Apache webserver
    [2]. Like the other recent Apache XSS bugs, this only affects servers
    using a combination of "UseCanonicalName off" (_not_ the default in
    OpenPKG package of Apache) and a wildcard A record of the server in
    the DNS. Although this combination for HTTPS servers is even less
    common than with plain HTTP servers, this nevertheless could allow
    remote attackers to execute client-side script code as other web page
    visitors via the HTTP "Host" header.

References:
    [1]  http://www.modssl.org/
    [2]  http://httpd.apache.org/
    [3]  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0840
    [4]  http://www.openpkg.org/tutorial.html#regular-source
    [5]  ftp://ftp.openpkg.org/release/1.0/UPD/apache-1.3.22-1.0.6.src.rpm
    [6]  ftp://ftp.openpkg.org/release/1.1/UPD/apache-1.3.26-1.1.2.src.rpm
    [7]  ftp://ftp.openpkg.org/current/SRC/apache-1.3.27-20021023.src.rpm
    [8]  http://www.openpkg.org/security.html#signature


Primary Package Name:    apache
Primary Package Home:    http://openpkg.org/go/package/apache

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.0-SOLID         apache-1.3.22-1.0.5
OpenPKG Community        1.1-SOLID         apache-1.3.26-1.1.1
OpenPKG Community        CURRENT           apache-1.3.27-20021009

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.0-SOLID         apache-1.3.22-1.0.6
OpenPKG Community        1.1-SOLID         apache-1.3.26-1.1.2
OpenPKG Community        CURRENT           apache-1.3.27-20021023