[ MDVSA-2009:091 ] mod_perl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:091
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mod_perl
Date : April 12, 2009
Affected: 2008.1, 2009.0, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in mod_perl v1.x and v2.x:
Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status
and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP
Server, when /perl-status is accessible, allows remote attackers to
inject arbitrary web script or HTML via the URI (CVE-2009-0796).
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0796
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
1d205036b1dbd484e9024fa0e2dc1fe1
2008.1/i586/apache-mod_perl-2.0.4-1.1mdv2008.1.i586.rpm
942265eb68c831addfa004033cbeb723
2008.1/i586/apache-mod_perl-devel-2.0.4-1.1mdv2008.1.i586.rpm
975f3c6f533577713c15f37da0495f58
2008.1/SRPMS/apache-mod_perl-2.0.4-1.1mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
668d1aea2e07c7999afc22e05a25d1dd
2008.1/x86_64/apache-mod_perl-2.0.4-1.1mdv2008.1.x86_64.rpm
7025760de956d57bb70fa4d8e82cb398
2008.1/x86_64/apache-mod_perl-devel-2.0.4-1.1mdv2008.1.x86_64.rpm
975f3c6f533577713c15f37da0495f58
2008.1/SRPMS/apache-mod_perl-2.0.4-1.1mdv2008.1.src.rpm
Mandriva Linux 2009.0:
01398435bd1a204c7bf6bc02fd6dc5b7
2009.0/i586/apache-mod_perl-2.0.4-2.1mdv2009.0.i586.rpm
40d0d1b7f617eeae983b9c02136823ef
2009.0/i586/apache-mod_perl-devel-2.0.4-2.1mdv2009.0.i586.rpm
f7dac6aa0996078878dc2bf3923a27f0
2009.0/SRPMS/apache-mod_perl-2.0.4-2.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
0e24b8d807bba4b117bce2c9c86955e0
2009.0/x86_64/apache-mod_perl-2.0.4-2.1mdv2009.0.x86_64.rpm
e3fee0b48c8ed0b7e7202cc38e554edf
2009.0/x86_64/apache-mod_perl-devel-2.0.4-2.1mdv2009.0.x86_64.rpm
f7dac6aa0996078878dc2bf3923a27f0
2009.0/SRPMS/apache-mod_perl-2.0.4-2.1mdv2009.0.src.rpm
Corporate 3.0:
14b008d79f846af06fbf12129cdaa712
corporate/3.0/i586/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.i586.rpm
718172be629f96bd60dea087d38ab32a
corporate/3.0/i586/apache2-mod_perl-devel-2.0.48_1.99_11-3.2.C30mdk.i586.rpm
8455048db64d2612bfe98b42fc2264ec
corporate/3.0/i586/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.i586.rpm
142cbfb23709370eb4a1e772c2ccd2dc
corporate/3.0/i586/HTML-Embperl-1.3.29_1.3.6-3.3.C30mdk.i586.rpm
623ee8abce645fe5559113b20fbd0b85
corporate/3.0/i586/mod_perl-common-1.3.29_1.29-3.3.C30mdk.i586.rpm
0ba166ad17f61307f96488a4ed32b63f
corporate/3.0/i586/mod_perl-devel-1.3.29_1.29-3.3.C30mdk.i586.rpm
b851faef67b39398298a45036eca7a7a
corporate/3.0/SRPMS/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.src.rpm
0cd8b877c25b480297c538ecb7bbc452
corporate/3.0/SRPMS/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
aa391fc09b4218fa9828c74811429d0b
corporate/3.0/x86_64/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.x86_64.rpm
de6a746e8ef88144a2dded6699bc3e2f
corporate/3.0/x86_64/apache2-mod_perl-devel-2.0.48_1.99_11-3.2.C30mdk.x86_64.rpm
73f77bd0290ca076407ca46a56a9ff1f
corporate/3.0/x86_64/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.x86_64.rpm
192ff89d1e34960b3dbaf70e74017ebb
corporate/3.0/x86_64/HTML-Embperl-1.3.29_1.3.6-3.3.C30mdk.x86_64.rpm
7290a44b466c12f5615e8fb8eac28f84
corporate/3.0/x86_64/mod_perl-common-1.3.29_1.29-3.3.C30mdk.x86_64.rpm
8fa64c7ff1713505a62ead1624ceacd1
corporate/3.0/x86_64/mod_perl-devel-1.3.29_1.29-3.3.C30mdk.x86_64.rpm
b851faef67b39398298a45036eca7a7a
corporate/3.0/SRPMS/apache2-mod_perl-2.0.48_1.99_11-3.2.C30mdk.src.rpm
0cd8b877c25b480297c538ecb7bbc452
corporate/3.0/SRPMS/apache-mod_perl-1.3.29_1.29-3.3.C30mdk.src.rpm
Corporate 4.0:
ca5870b0c9804b047f5029644c06e863
corporate/4.0/i586/apache-mod_perl-2.0.2-8.2.20060mlcs4.i586.rpm
d34ca151d1234922b01aef484bb4358c
corporate/4.0/i586/apache-mod_perl-devel-2.0.2-8.2.20060mlcs4.i586.rpm
e94cd2da56d1ad8fe1bd045f8e4a0377
corporate/4.0/SRPMS/apache-mod_perl-2.0.2-8.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
1710aeba439a3de8701c37c8aafc03db
corporate/4.0/x86_64/apache-mod_perl-2.0.2-8.2.20060mlcs4.x86_64.rpm
41438909b8155a8fd55f1826351aded0
corporate/4.0/x86_64/apache-mod_perl-devel-2.0.2-8.2.20060mlcs4.x86_64.rpm
e94cd2da56d1ad8fe1bd045f8e4a0377
corporate/4.0/SRPMS/apache-mod_perl-2.0.2-8.2.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJ4bCOmqjQ0CJFipgRAmyTAKCLsSQhGpta3bB3LwZEPHQK5M7cugCdH9+F
UbapeDmrzrK/aZYQ61d4AJs=
=JZyQ
-----END PGP SIGNATURE-----