Re: [ANNOUNCE] mod_ssl 2.8.18

On Thu, May 27, 2004 at 05:09:17PM +0200, Boyle Owen wrote:
> > On Thu, May 27, 2004 at 15:21:37 +0200, Ralf S. Engelschall wrote:
> > >   Changes with mod_ssl 2.8.18 (11-May-2004 to 27-May-2004)
> > > 
> > >    *) Fix buffer overflow in "SSLOptions +FakeBasicAuth" 
> > implementation
> > >       if the Subject-DN in the client certificate exceeds 
> > 6KB in length.
> > >       (CVE CAN-2004-0488).
> > > 
> > 
> > Is that also an issue in apache-2.x? (I wasn't able to find 
> > that CVE, so I
> > ask here ;-)
> 
> The problem was originally identified on apache2 (see
> http://www.securityfocus.com/bid/10355/) and it has already been patched
> there. 

Anybody wanting to patch directly can fetch this:

http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/ssl/ssl_engine_kernel.c?r1=1.105&r2=1.106

> Incidentally, AFAIK there is no vulnerability unless you are using
> "SSLOptions FakeBasicAuth". It's a fairly specialised option so my
> feeling is that this doesn't urgently affect a whole lot of people... Of
> course, you should still upgrade just in case some time in the future
> you do switch that option on.

And furthermore, you must trust a CA who will issue a client cert with
exploit code embedded in the subject DN.

Regards,

joe
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]