RHEL 2.1 : mod_ssl (RHSA-2002:136)

medium Nessus Plugin ID 12310

Synopsis

The remote Red Hat host is missing a security update.

Description

Updated mod_ssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of mod_ssl up to and including version 2.8.9.

The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. Versions of mod_ssl prior to 2.8.10 are subject to a single NULL overflow that can cause arbitrary code execution.

In order to exploit this vulnerability, the Apache Web server has to be configured to allow overriding of configuration settings on a per-directory basis, and untrusted local users must be able to modify a directory in which the server is configured to allow overriding. The local attacker may then become the user that Apache is running as (usually 'www' or 'nobody').

Note that regardless of this bug, local users can obtain the same privileges if the server is configured to allow them to create CGI scripts which run as the Web server user, or if PHP is enabled but not configured in 'safe mode'.

The errata packages contain versions of mod_ssl that have been patched and are not vulnerable to this issue.

Please note that you must restart the httpd daemon to use the updated module. For instructions on doing this, see the bottom of the Solutions section below.

Solution

Update the affected mod_ssl package.

Plugin Details

Severity: Medium

ID: 12310

File Name: redhat-RHSA-2002-136.nasl

Version: 1.22

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 7/6/2004

Updated: 1/14/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:mod_ssl, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 7/16/2002

Vulnerability Publication Date: 7/11/2002

Reference Information

CVE: CVE-2002-0653

RHSA: 2002:136

Detections

Analytics