Bug 5062 - apache-mod_fcgid new security issue CVE-2012-1181
Summary: apache-mod_fcgid new security issue CVE-2012-1181
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 1
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard:
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2012-03-23 00:59 CET by David Walser
Modified: 2012-04-11 21:09 CEST (History)
3 users (show)

See Also:
Source RPM: apache-mod_fcgid-2.3.6-0.1.mga1.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2012-03-23 00:59:27 CET
An update candidate is in updates_testing

Advisory:
========================

Updated apache-mod_fcgid package fixes security vulnerability:

fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server
does not recognize the FcgidMaxProcessesPerClass directive for a virtual
host, which makes it easier for remote attackers to cause a denial of service
(memory consumption) via a series of HTTP requests that triggers a process
count higher than the intended limit (CVE-2012-1181).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1181
https://issues.apache.org/bugzilla/show_bug.cgi?id=49902
========================

Updated packages in core/updates_testing:
========================
apache-mod_fcgid-2.3.6-0.2.mga1

from apache-mod_fcgid-2.3.6-0.2.mga1.src.rpm
Comment 1 claire robinson 2012-03-23 13:57:43 CET
Some examples here - http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html
Comment 2 Dave Hodgins 2012-04-04 21:32:28 CEST
Testing complete on i586 for the srpm
apache-mod_fcgid-2.3.6-0.2.mga1.src.rpm

Just testing using https://localhost/phpinfo,
which works and shows the module is loaded.

CC: (none) => davidwhodgins

Comment 3 Manuel Hiebel 2012-04-11 01:45:53 CEST
testing complete on x86_64


Suggested Advisory:
-------------
Updated apache-mod_fcgid package fixes security vulnerability:

fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server
does not recognize the FcgidMaxProcessesPerClass directive for a virtual
host, which makes it easier for remote attackers to cause a denial of service
(memory consumption) via a series of HTTP requests that triggers a process
count higher than the intended limit (CVE-2012-1181).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1181
https://issues.apache.org/bugzilla/show_bug.cgi?id=49902

https://bugs.mageia.org/show_bug.cgi?id=5062#c2
-------------

SRPM: apache-mod_fcgid-2.3.6-0.2.mga1.src.rpm

Could sysadmin please push from core/updates_testing to core/updates

Thankyou!

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 4 Thomas Backlund 2012-04-11 21:09:00 CEST
Update pushed

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.