Your message dated Wed, 8 Dec 2010 22:00:26 +0100
with message-id <[email protected]>
and subject line Re: libapache2-mod-fcgid: stack overwrite vulnerability
has caused the Debian Bug report #605484,
regarding libapache2-mod-fcgid: stack overwrite vulnerability
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
605484: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605484
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libapache2-mod-fcgid
Version: 1:2.2-1
Severity: grave
Tags: security
Justification: user security hole
This was reported in CVE-2010-3872. Information at:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3872
https://issues.apache.org/bugzilla/show_bug.cgi?id=49406
Of particular note, the code in question appears at line 86 in the
lenny version, and is:
memcpy(&header + hasread, buffer, putsize);
Our versions in lenny and lenny-backports are both vulnerable.
squeeze and sid are running new enough versions that they aren't.
-- System Information:
Debian Release: 5.0.7
APT prefers stable
APT policy: (500, 'stable'), (99, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-2-686 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libapache2-mod-fcgid depends on:
ii apache2.2-common 2.2.9-10+lenny8 Apache HTTP Server common files
ii libc6 2.7-18lenny6 GNU C Library: Shared libraries
libapache2-mod-fcgid recommends no packages.
libapache2-mod-fcgid suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 1:2.3.6-1
On Tue, Nov 30, 2010 at 08:40:44AM -0600, John Goerzen wrote:
> Package: libapache2-mod-fcgid
> Version: 1:2.2-1
> Severity: grave
> Tags: security
> Justification: user security hole
>
> This was reported in CVE-2010-3872. Information at:
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3872
>
> https://issues.apache.org/bugzilla/show_bug.cgi?id=49406
>
> Of particular note, the code in question appears at line 86 in the
> lenny version, and is:
>
> memcpy(&header + hasread, buffer, putsize);
>
>
> Our versions in lenny and lenny-backports are both vulnerable.
> squeeze and sid are running new enough versions that they aren't.
Marking unstable as fixed.
Cheers,
Moritz
--- End Message ---
