Apache ssl_hook_Access() Function May Fail to Verify Client Certificates
|
|
SecurityTracker Alert ID: 1014833 |
|
SecurityTracker URL: http://securitytracker.com/id/1014833
|
|
CVE Reference:
CVE-2005-2700
(Links to External Site)
|
Updated: Mar 2 2006
|
Original Entry Date: Sep 1 2005
|
Impact:
Host/resource access via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 2.0.x
|
Description:
A vulnerability was reported in Apache. The server may fail to verify SSL client certificates in a certain configuration
The Apache ssl_hook_Access() function does not properly enforce the 'SSLVerifyClient require' directive in a per-location context if a virtual host is configured with the 'SSLVerifyCLient optional' directive.
The vulnerability resides in 'modules/ssl/ssl_engine_kernel.c'.
|
Impact:
The server may fail to verify SSL client certificates in a certain configuration.
|
Solution:
The vendor has issued a source code fix, available via SVN at:
http://svn.apache.org/viewcvs?rev=264800&view=rev
Red Hat has issued a fix for mod_ssl for Red Hat Enterprise Linux 2.1:
https://rhn.redhat.com/errata/RHSA-2005-773.html
HP has issued a fix for Apache on HP-UX:
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01232
|
Vendor URL: httpd.apache.org/ (Links to External Site)
|
Cause:
Authentication error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
