Home / mailings [RHSA-2007:0395-01] Low: mod_perl security update
Posted on 14 June 2007
RedHat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Low: mod_perl security update
Advisory ID: RHSA-2007:0395-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0395.html
Issue date: 2007-06-14
Updated on: 2007-06-14
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-1349
- ---------------------------------------------------------------------
1. Summary:
Updated mod_perl packages that fix a security issue are now available for Red
Hat Enterprise Linux 3, 4, 5.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
3. Problem description:
Mod_perl incorporates a Perl interpreter into the Apache web server,
so that the Apache web server can directly execute Perl code.
An issue was found in the "namespace_from_uri" method of the
ModPerl::RegistryCooker class. If a server implemented a mod_perl registry
module using this method, a remote attacker requesting a carefully crafted
URI can cause resource consumption, which could lead to a denial of service
(CVE-2007-1349).
Users of mod_perl should update to these erratum packages which contain a
backported fix to correct this issue.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
240423 - CVE-2007-1349 mod_perl PerlRun denial of service
6. RPMs required:
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/mod_perl-1.99_09-12.ent.src.rpm
0171ede91bda294c9be41a393f5cb6d4 mod_perl-1.99_09-12.ent.src.rpm
i386:
7a27f7eeab936185438be6dc21b9f163 mod_perl-1.99_09-12.ent.i386.rpm
bb9099e9ee421f19a2768d40450d0eb2 mod_perl-debuginfo-1.99_09-12.ent.i386.rpm
c03fca36402721ef0f24a14a0349eb3e mod_perl-devel-1.99_09-12.ent.i386.rpm
ia64:
5f64caab9566ec78fea2f49925dcb66c mod_perl-1.99_09-12.ent.ia64.rpm
998b5500b2df651f99017a867746b4f0 mod_perl-debuginfo-1.99_09-12.ent.ia64.rpm
c8841a63e4054afa07076bf719f6f1cc mod_perl-devel-1.99_09-12.ent.ia64.rpm
ppc:
4041e7498c8526fcaeb145c5554c6e1b mod_perl-1.99_09-12.ent.ppc.rpm
d84cb273691d33c2fdfce46f50e3b42f mod_perl-debuginfo-1.99_09-12.ent.ppc.rpm
c7d0ed21a61c6579848e0aed3472900c mod_perl-devel-1.99_09-12.ent.ppc.rpm
s390:
2167d5d188ccdf80c274b96ad6efe2fe mod_perl-1.99_09-12.ent.s390.rpm
8efd1ba4c9546113efbf3a95adafa276 mod_perl-debuginfo-1.99_09-12.ent.s390.rpm
74142958130662ae1c6c8a8c995d3b95 mod_perl-devel-1.99_09-12.ent.s390.rpm
s390x:
02d6617187e67c53974755ed6feea8bf mod_perl-1.99_09-12.ent.s390x.rpm
cd8c7c0c85d432e7b28b1e704016c544 mod_perl-debuginfo-1.99_09-12.ent.s390x.rpm
ba41190b70652a9f0a6d03f1dddc3a6e mod_perl-devel-1.99_09-12.ent.s390x.rpm
x86_64:
2a5a9082da94bda6b7a798bfad7ebd29 mod_perl-1.99_09-12.ent.x86_64.rpm
c1d7060c4d04c5282161c2fefae15cc2 mod_perl-debuginfo-1.99_09-12.ent.x86_64.rpm
53529e39663be959990b371f03da7e74 mod_perl-devel-1.99_09-12.ent.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/mod_perl-1.99_09-12.ent.src.rpm
0171ede91bda294c9be41a393f5cb6d4 mod_perl-1.99_09-12.ent.src.rpm
i386:
7a27f7eeab936185438be6dc21b9f163 mod_perl-1.99_09-12.ent.i386.rpm
bb9099e9ee421f19a2768d40450d0eb2 mod_perl-debuginfo-1.99_09-12.ent.i386.rpm
c03fca36402721ef0f24a14a0349eb3e mod_perl-devel-1.99_09-12.ent.i386.rpm
x86_64:
2a5a9082da94bda6b7a798bfad7ebd29 mod_perl-1.99_09-12.ent.x86_64.rpm
c1d7060c4d04c5282161c2fefae15cc2 mod_perl-debuginfo-1.99_09-12.ent.x86_64.rpm
53529e39663be959990b371f03da7e74 mod_perl-devel-1.99_09-12.ent.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/mod_perl-1.99_09-12.ent.src.rpm
0171ede91bda294c9be41a393f5cb6d4 mod_perl-1.99_09-12.ent.src.rpm
i386:
7a27f7eeab936185438be6dc21b9f163 mod_perl-1.99_09-12.ent.i386.rpm
bb9099e9ee421f19a2768d40450d0eb2 mod_perl-debuginfo-1.99_09-12.ent.i386.rpm
c03fca36402721ef0f24a14a0349eb3e mod_perl-devel-1.99_09-12.ent.i386.rpm
ia64:
5f64caab9566ec78fea2f49925dcb66c mod_perl-1.99_09-12.ent.ia64.rpm
998b5500b2df651f99017a867746b4f0 mod_perl-debuginfo-1.99_09-12.ent.ia64.rpm
c8841a63e4054afa07076bf719f6f1cc mod_perl-devel-1.99_09-12.ent.ia64.rpm
x86_64:
2a5a9082da94bda6b7a798bfad7ebd29 mod_perl-1.99_09-12.ent.x86_64.rpm
c1d7060c4d04c5282161c2fefae15cc2 mod_perl-debuginfo-1.99_09-12.ent.x86_64.rpm
53529e39663be959990b371f03da7e74 mod_perl-devel-1.99_09-12.ent.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/mod_perl-1.99_09-12.ent.src.rpm
0171ede91bda294c9be41a393f5cb6d4 mod_perl-1.99_09-12.ent.src.rpm
i386:
7a27f7eeab936185438be6dc21b9f163 mod_perl-1.99_09-12.ent.i386.rpm
bb9099e9ee421f19a2768d40450d0eb2 mod_perl-debuginfo-1.99_09-12.ent.i386.rpm
c03fca36402721ef0f24a14a0349eb3e mod_perl-devel-1.99_09-12.ent.i386.rpm
ia64:
5f64caab9566ec78fea2f49925dcb66c mod_perl-1.99_09-12.ent.ia64.rpm
998b5500b2df651f99017a867746b4f0 mod_perl-debuginfo-1.99_09-12.ent.ia64.rpm
c8841a63e4054afa07076bf719f6f1cc mod_perl-devel-1.99_09-12.ent.ia64.rpm
x86_64:
2a5a9082da94bda6b7a798bfad7ebd29 mod_perl-1.99_09-12.ent.x86_64.rpm
c1d7060c4d04c5282161c2fefae15cc2 mod_perl-debuginfo-1.99_09-12.ent.x86_64.rpm
53529e39663be959990b371f03da7e74 mod_perl-devel-1.99_09-12.ent.x86_64.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/mod_perl-1.99_16-4.5.src.rpm
ef24c627d47dc3d60d0bde85403517fb mod_perl-1.99_16-4.5.src.rpm
i386:
5e63180e9f49603b9a7eea1d1a436f66 mod_perl-1.99_16-4.5.i386.rpm
4b4018411e3efc86b2ab52c95de1d8f0 mod_perl-debuginfo-1.99_16-4.5.i386.rpm
1547f7f7bb7203623e0e047af674db00 mod_perl-devel-1.99_16-4.5.i386.rpm
ia64:
776b91d6d9f1f6bfabde74adf613ed60 mod_perl-1.99_16-4.5.ia64.rpm
19425f9b399fc407ae8cad28f802c0ee mod_perl-debuginfo-1.99_16-4.5.ia64.rpm
d1fe40da7d74a8d049bbe79b2a52d53a mod_perl-devel-1.99_16-4.5.ia64.rpm
ppc:
66dc96eeee73965d1a24fd44517f9342 mod_perl-1.99_16-4.5.ppc.rpm
bbb06acd7723fdaa8a04cfb98d8bbef0 mod_perl-debuginfo-1.99_16-4.5.ppc.rpm
c04efe5898b7860ba01fe897a2cc48fe mod_perl-devel-1.99_16-4.5.ppc.rpm
s390:
5cd551206c9c35d256b63a2bbcbf6791 mod_perl-1.99_16-4.5.s390.rpm
31999ab1473a4768e8c4b00d27f6e777 mod_perl-debuginfo-1.99_16-4.5.s390.rpm
b8a90ccd2ef7f742efd4c540928162d4 mod_perl-devel-1.99_16-4.5.s390.rpm
s390x:
73021886d359704621a32441c9d0a463 mod_perl-1.99_16-4.5.s390x.rpm
6402d499f267e9d239168b7f438037ee mod_perl-debuginfo-1.99_16-4.5.s390x.rpm
73862cb7007c793a962db49b23dd2162 mod_perl-devel-1.99_16-4.5.s390x.rpm
x86_64:
8f98dc9f7ea3a2ff88e9ecc748486836 mod_perl-1.99_16-4.5.x86_64.rpm
8b5a37d1ed9134bcac2b22e1dab1ad1e mod_perl-debuginfo-1.99_16-4.5.x86_64.rpm
0f4ebf1d9ad592316fe2f5941b72ee02 mod_perl-devel-1.99_16-4.5.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/mod_perl-1.99_16-4.5.src.rpm
ef24c627d47dc3d60d0bde85403517fb mod_perl-1.99_16-4.5.src.rpm
i386:
5e63180e9f49603b9a7eea1d1a436f66 mod_perl-1.99_16-4.5.i386.rpm
4b4018411e3efc86b2ab52c95de1d8f0 mod_perl-debuginfo-1.99_16-4.5.i386.rpm
1547f7f7bb7203623e0e047af674db00 mod_perl-devel-1.99_16-4.5.i386.rpm
x86_64:
8f98dc9f7ea3a2ff88e9ecc748486836 mod_perl-1.99_16-4.5.x86_64.rpm
8b5a37d1ed9134bcac2b22e1dab1ad1e mod_perl-debuginfo-1.99_16-4.5.x86_64.rpm
0f4ebf1d9ad592316fe2f5941b72ee02 mod_perl-devel-1.99_16-4.5.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/mod_perl-1.99_16-4.5.src.rpm
ef24c627d47dc3d60d0bde85403517fb mod_perl-1.99_16-4.5.src.rpm
i386:
5e63180e9f49603b9a7eea1d1a436f66 mod_perl-1.99_16-4.5.i386.rpm
4b4018411e3efc86b2ab52c95de1d8f0 mod_perl-debuginfo-1.99_16-4.5.i386.rpm
1547f7f7bb7203623e0e047af674db00 mod_perl-devel-1.99_16-4.5.i386.rpm
ia64:
776b91d6d9f1f6bfabde74adf613ed60 mod_perl-1.99_16-4.5.ia64.rpm
19425f9b399fc407ae8cad28f802c0ee mod_perl-debuginfo-1.99_16-4.5.ia64.rpm
d1fe40da7d74a8d049bbe79b2a52d53a mod_perl-devel-1.99_16-4.5.ia64.rpm
x86_64:
8f98dc9f7ea3a2ff88e9ecc748486836 mod_perl-1.99_16-4.5.x86_64.rpm
8b5a37d1ed9134bcac2b22e1dab1ad1e mod_perl-debuginfo-1.99_16-4.5.x86_64.rpm
0f4ebf1d9ad592316fe2f5941b72ee02 mod_perl-devel-1.99_16-4.5.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/mod_perl-1.99_16-4.5.src.rpm
ef24c627d47dc3d60d0bde85403517fb mod_perl-1.99_16-4.5.src.rpm
i386:
5e63180e9f49603b9a7eea1d1a436f66 mod_perl-1.99_16-4.5.i386.rpm
4b4018411e3efc86b2ab52c95de1d8f0 mod_perl-debuginfo-1.99_16-4.5.i386.rpm
1547f7f7bb7203623e0e047af674db00 mod_perl-devel-1.99_16-4.5.i386.rpm
ia64:
776b91d6d9f1f6bfabde74adf613ed60 mod_perl-1.99_16-4.5.ia64.rpm
19425f9b399fc407ae8cad28f802c0ee mod_perl-debuginfo-1.99_16-4.5.ia64.rpm
d1fe40da7d74a8d049bbe79b2a52d53a mod_perl-devel-1.99_16-4.5.ia64.rpm
x86_64:
8f98dc9f7ea3a2ff88e9ecc748486836 mod_perl-1.99_16-4.5.x86_64.rpm
8b5a37d1ed9134bcac2b22e1dab1ad1e mod_perl-debuginfo-1.99_16-4.5.x86_64.rpm
0f4ebf1d9ad592316fe2f5941b72ee02 mod_perl-devel-1.99_16-4.5.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mod_perl-2.0.2-6.3.el5.src.rpm
aaf3252fc98947caed9fb49b2a6a87e1 mod_perl-2.0.2-6.3.el5.src.rpm
i386:
d88c0b0178e1d44098cc00f6c247ebcf mod_perl-2.0.2-6.3.el5.i386.rpm
d79f24f895ebe4de2923dbfecd89de87 mod_perl-debuginfo-2.0.2-6.3.el5.i386.rpm
99370acfad55f35e875800b5fe703188 mod_perl-devel-2.0.2-6.3.el5.i386.rpm
x86_64:
a4d8aee3ed9cb230b89248677a3243b7 mod_perl-2.0.2-6.3.el5.x86_64.rpm
d79f24f895ebe4de2923dbfecd89de87 mod_perl-debuginfo-2.0.2-6.3.el5.i386.rpm
04a8a5b22bf4817d7033df0763a3978e mod_perl-debuginfo-2.0.2-6.3.el5.x86_64.rpm
99370acfad55f35e875800b5fe703188 mod_perl-devel-2.0.2-6.3.el5.i386.rpm
52528ac5a225844b60be1e12970708e6 mod_perl-devel-2.0.2-6.3.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/mod_perl-2.0.2-6.3.el5.src.rpm
aaf3252fc98947caed9fb49b2a6a87e1 mod_perl-2.0.2-6.3.el5.src.rpm
i386:
d88c0b0178e1d44098cc00f6c247ebcf mod_perl-2.0.2-6.3.el5.i386.rpm
d79f24f895ebe4de2923dbfecd89de87 mod_perl-debuginfo-2.0.2-6.3.el5.i386.rpm
99370acfad55f35e875800b5fe703188 mod_perl-devel-2.0.2-6.3.el5.i386.rpm
ia64:
b4788c1cd93d88c69fb4b0cbb25477d1 mod_perl-2.0.2-6.3.el5.ia64.rpm
2c10a2e3d94e17acf18a3f4596cae27a mod_perl-debuginfo-2.0.2-6.3.el5.ia64.rpm
b0cb019e4c281b170f5ecdab8d06d357 mod_perl-devel-2.0.2-6.3.el5.ia64.rpm
ppc:
fbb746e182f83cf75783ed3c3f5d0f3c mod_perl-2.0.2-6.3.el5.ppc.rpm
5ba73ca5d3271f18577bbd13ce5dc41a mod_perl-debuginfo-2.0.2-6.3.el5.ppc.rpm
230e622df873ee4b919056fc6c3c74ca mod_perl-debuginfo-2.0.2-6.3.el5.ppc64.rpm
cc9eab5a407bb1aa32044322bba3f066 mod_perl-devel-2.0.2-6.3.el5.ppc.rpm
55d56ce508f54b17d2fa16b6d3f559ff mod_perl-devel-2.0.2-6.3.el5.ppc64.rpm
s390x:
f78ffe414aaae20c21e0d4c1550c8fa6 mod_perl-2.0.2-6.3.el5.s390x.rpm
a3ccc43c7865763b5f07c63be0a58574 mod_perl-debuginfo-2.0.2-6.3.el5.s390.rpm
7a59907c7709c6ba64d584456299b89b mod_perl-debuginfo-2.0.2-6.3.el5.s390x.rpm
1f4907d85ca489b496c203f5709ca12e mod_perl-devel-2.0.2-6.3.el5.s390.rpm
1b7a27618ede9a54e840167cf048b191 mod_perl-devel-2.0.2-6.3.el5.s390x.rpm
x86_64:
a4d8aee3ed9cb230b89248677a3243b7 mod_perl-2.0.2-6.3.el5.x86_64.rpm
d79f24f895ebe4de2923dbfecd89de87 mod_perl-debuginfo-2.0.2-6.3.el5.i386.rpm
04a8a5b22bf4817d7033df0763a3978e mod_perl-debuginfo-2.0.2-6.3.el5.x86_64.rpm
99370acfad55f35e875800b5fe703188 mod_perl-devel-2.0.2-6.3.el5.i386.rpm
52528ac5a225844b60be1e12970708e6 mod_perl-devel-2.0.2-6.3.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1349
http://www.redhat.com/security/updates/classification/#low
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
