[CentOS-devel] CVE-2011-3192 rpms for CentOS 5 still pending? dfrg.msc dfrg.msc at gmail.com Wed Sep 7 04:20:11 UTC 2011 Previous message: [CentOS-devel] Does CentOS 6 udev rule format diff from CentOS 5? Next message: [CentOS-devel] CVE-2011-3192 rpms for CentOS 5 still pending? Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] According to the CentOS-CR-Announce list, there is recen
CVSS v2 ã«ããæ·±å»åº¦ åºæ¬å¤: 7.8 (å±éº) [NVDå¤] æ»æå åºå: ãããã¯ã¼ã¯ æ»ææ¡ä»¶ã®è¤éã: ä½ æ»æåã®èªè¨¼è¦å¦: ä¸è¦ æ©å¯æ§ã¸ã®å½±é¿(C): ãªã å®å ¨æ§ã¸ã®å½±é¿(I): ãªã å¯ç¨æ§ã¸ã®å½±é¿(A): å ¨é¢ç Apache Software Foundation Apache HTTP Server 1.3 系 Apache HTTP Server 2.x 系 IBM IBM HTTP Server 1.3 IBM HTTP Server 2.0 IBM HTTP Server 6.0 IBM HTTP Server 6.1 IBM HTTP Server 7.0 IBM HTTP Server 8.0 ã¢ããã« Apple Mac OS X v10.6.8 Apple Mac OS X v10.7 ããã³Â v10.7.1 Apple Mac OS X Se
Apacheã®èå¼±æ§(CVE-2011-3192)ããããApache killerã話é¡ã«ãªã£ã¦ãã¾ããããã®è å¨ã«ã¤ãã¦ã¯ä¸é¨èª¤è§£ãããããã§ãã 以ä¸ã¯ãé常ã«è å¨ã¨ããå ±åã®ä¾ã§ãã ä¸æ¹ä»åã®ã¯ããã»ã¹ã®è¥å¤§åãä¼´ãã®ã§ãå®ã¡ã¢ãªæ¶è²»ãã¦æ´ã«ã¹ã¯ããã使ãå°½ããã¦OSæ¯æ¿éã«ãªã£ããããLinuxã¨ãã®å ´åã¯OOM Killerçºåã¨ãä»ã®ããã»ã¹ãå ´åã«ãã£ã¦ã¯OSãå·»ãè¾¼ãã§éã£ã¦ãã¾ãã¾ãã CVE-2011-3192 Range header DoS vulnerability Apache HTTPD 1.3/2.xããå¼ç¨ 以ä¸ã¯ãããã»ã©è å¨ã§ãªãã£ãã¨ããå ±åã®ä¾ã§ãã pooh.gr.jp ã¯çµæ§é ä¸ã ã£ãã®ã§ 60 並åã§ãã£ã¨ CPU idle 30% ã¾ã§æ¸ãããã Apache Killer (CVE-2011-3192) 対ç for CentOS 5
æ¤è¨¼ Exploit Code 㯠Apache Killer (killapache.pl) ããã apachepartial.pl ã®ã»ãã Perl ã¢ã¸ã¥ã¼ã« Parallel::ForkManager  ã®è¿½å ãè¦ããªãã®ã§æ¥½ã¡ãã Usage: ./apachepartial.pl <host> [path] [parallel reqs] [loops] [port] perl apachepartial.pl pooh.gr.jp /robots.txt 60 0 80 pooh.gr.jp ã¯çµæ§é ä¸ã ã£ãã®ã§ 60 並åã§ãã£ã¨ CPU idle 30% ã¾ã§æ¸ãããã path ã§æå®ããã³ã³ãã³ãã 1300 ãã¤ã以ä¸ã«ããã¨å¹æçã«ãªããrobots.txt ã¯ã¡ã£ããã®ã§æ»æå¹æãä½ããªã£ãã¿ããã 対çãå®è¡ããããã¾ããµã¼ãã¹ã«å½±é¿ããªããã確èªãããã
æ°æ¥åããFull Disclosureã§é¨ããã¦ããã©ãã£ã¨CVEæ¡çªãããã®ã§ã 以åã®ISC BINDã®èå¼±æ§(CVE-2011-1910)ã¨ãã«æ¯ã¹ãã¨zero-dayç¶æ ã« ãªã£ãã«ãé¢ãããApacheå´ã®åããé ãæ°ããã¾ãã(表ã«è¦ãã¦ãªãã£ãã ãï¼) ã¢ããã¤ã¶ãªã¯ä»¥ä¸ CVE-2011-3192 Range header DoS vulnerability Apache HTTPD 1.3/2.x http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/raw/%[email protected]%3E/ DoSã ãã¨ãã£ã¦ãã¾ãã°ããã¾ã§ã§ãããApache HTTPDã§ã¯ä¹ ãã¶ãã« ç¾æç¹ã§åºã¦ããå ¨ãã¼ã¸ã§ã³ã対象 (2011/
2011å¹´08æ26æ¥03:03 ï¼ï½ï½é¯è½ã¡ãä»åã®ç¯äººã¯ããã¤ãï½ï½ï½ï½ï½ï½ï½ï½ï½ï½ï½ï½ï½ï½ 1ï¼ä»¥ä¸ãåç¡ãã«ãããã¾ãã¦VIPããéããã¾ãï¼2011/08/26(é) 02:31:36.65 ID:VVfWsJbN0 ã³ããã ããããåå ãããã ä»åã¯éå½ãããªãã¦2chéç¨ã®é¦¬é¹¿ãåå Apache Web Serverã«æªè§£æ±ºã®èå¼±æ§ãåå¨ãããã®èå¼±æ§ãçªããæ»æã横è¡ãã¦ããã¨ãã¦ã Apache Software Foundationã8æ24æ¥ä»ï¼ç±³å½æéï¼ã®ã¢ããã¤ã¶ãªã¼ã§æ³¨æãä¿ããã ã¢ããã¤ã¶ãªã¼ã«ããã¨ãApacheã§Rangeãªã¯ã¨ã¹ããå¦çããæ¹æ³ã«ãµã¼ãã¹å¦¨å®³ï¼DoSï¼ã®èå¼±æ§ãåå¨ããã å½±é¿ãåããã®ã¯Apache 1.3ã¨Apache 2ã®å ¨ãã¼ã¸ã§ã³ãèå¼±æ§ãçªãã¦ãªã¢ã¼ãããæ»æãåããã¨ã大éã®ã¡ã¢ãªã¨CPUãæ¶è²»ããã¦ãã¾ãæããããã
Archives January 2017Â (1) December 2016Â (2) October 2016Â (2) August 2016Â (2) June 2016Â (3) May 2016Â (3) February 2016Â (3) January 2016Â (6) December 2015Â (4) November 2015Â (1) July 2015Â (1) December 2014Â (4) November 2014Â (1) October 2014Â (2) August 2014Â (1) July 2014Â (1) June 2014Â (2) April 2014Â (4) February 2014Â (3) January 2014Â (1) December 2013Â (2) September 2013Â (1) August 2013Â (3) July 2013Â (
ãããã¤ã³ã¹ãã¼ã«ä»£è¡¨ã®ã©ã¤ãããã¯ããã°
Module mod_mime This module provides for determining the types of files from the filename and for association of handlers with files. Status: Base Source File: mod_mime.c Module Identifier: mime_module Summary This module is used to determine various bits of "meta information" about documents. This information relates to the content of the document and is returned to the browser or used in content
Posted on: 2010-04-13 05:04:50+00:00 Apache.org services recently suffered a direct, targeted attack against our infrastructure, specifically the server hosting our issue-tracking software. The Apache Software Foundation uses a donated instance of Atlassian JIRA as an issue tracker for our projects. Among other projects, the ASF Infrastructure Team uses it to track issues and requests. Our JIRA in
ãã°ãã©ããã³ã°ã½ããããã¹ãã£ã³ã°ãã¦ãããµã¼ããæ»æãåããJIRAãBugzillaãConfluenceã®ã¦ã¼ã¶ã¼ã®ãã¹ã¯ã¼ããæµåºããæããããã¨ããã Apache Software Foundationã¯4æ13æ¥ããã°ãã©ããã³ã°ã½ãããJIRAãããã¹ãã£ã³ã°ãã¦ãããµã¼ããæ»æãåããã¨ããã°ã§çºè¡¨ããããã®æ»æã«ãããApacheã§ãã¹ãã£ã³ã°ãã¦ããJIRAãBugzillaãConfluenceã®ã¦ã¼ã¶ã¼ã®ããã·ã¥åããããã¹ã¯ã¼ããæµåºããæããããã¨è¦åããã Apacheã«ããã°ãæ»æã«ã¯ç縮URLãµã¼ãã¹ã®TinyURLã使ã£ã¦ã¯ãã¹ãµã¤ãã¹ã¯ãªããã£ã³ã°ï¼XSSï¼æ»æã³ã¼ããä»è¾¼ãã URLã¸ãªãã¤ã¬ã¯ãããæå£ã使ãããã¨ãããApacheã®ç®¡çè æ°äººããã®ãªã³ã¯ãã¯ãªãã¯ãã¦ãã¾ããJIRA管ç権éãå«ãã»ãã·ã§ã³ã«ä¾µå ¥ãããã ããã«XSSæ»æã¨ä¸¦è¡
(追è¨: ç¶ç·¨ãupãã¾ãããè¨å®ä¾ã¨åä½æ¤è¨¼ãè¡ã£ã¦ãã¾ããâãã¡ãã¸ã©ãã) Apacheã¨ããã°ãWebãµã¼ãã¹ãæ§ç¯ããä¸ã§ã ãããã©ããã§å¿ ããä¸è©±ã«ãªãã§ããããHTTPãµã¼ãã®ããã¡ã¯ãã¹ã¿ã³ãã¼ãã¨ãã¦å¹ åºãå®çããã½ããã¦ã§ã¢ã ã¨æãã¾ããKLabã§ãåæã§éç¨ãã¦ãä¸è©±ã«ãªã£ã¦ãã¾ãã ç¾å¨ããã¼ã¸ã§ã³ã¯2.2ç³»ãå®å®ç(stable branch)ã¨ãªã£ã¦ããã¾ãããéçºçã§ãã2.3ç³»ãæ¢ã«ä¸¦è¡ãã¦å ¬éããã¦ããã®ããåç¥ã§ãããããæ°ããæ©è½ãæè¡ãåãå ¥ãã¦è¡ãçºã«2.2ç³»ã¨ã®éã®äºææ§ãæã«ç ç²ã«ãã¤ã¤ãæ§ã ãªãã£ã¬ã³ã¸ãè¡ããã¦ããããã§ããå°æ¥çã«ã¯ãã®ãã¼ã¸ã§ã³ã2.4ç³»ã¨ãªã£ã¦æ°ããå®å®çã¨ãã¦æä¾ããããã¨ã«ãªãã§ãããã ãã®DSASããã°ã§ããApache 2.3ç³»ã§åãçµã¾ãã¦ããæ°ããæ©è½ã«ã¤ãã¦çç®ããé¢ç½ãããªãã®ãä¸ã¤ãã¤åãä¸ããªãã
Debian etchã®apache2.2-commonã«ã¯apache2-ssl-certificateãå ¥ã£ã¦ããªãã®ã§OpenSSLã§èªåã§ä½ã # vi /etc/ssl/openssl.cnf [usr_cert]ã»ã¯ã·ã§ã³ã®nsCertType=serverã®ã³ã¡ã³ãã¢ã¦ããå¤ã [v3_ca]ã»ã¯ã·ã§ã³ã®nsCertType=sslCA,emailCAã®ã³ã¡ã³ãã¢ã¦ããå¤ã # cd /usr/lib/ssl/misc/ # ./CA.sh -newca ãããã質åãããã®ã§çãã CA certificate filename (or enter to create)ã// ãã©ã³ã¯ã®ã¾ã¾Enter Enter PEM pass phrase: //é©å½ã« Verifying - Enter PEM pass phrase: //ç¢ºèª Country Name (2 le
ã»ãã¥ãªãã£ä¸ã¯ãã¹ãã¬ã¼ãºã¤ãã®éµããå§ããã¾ããã以ä¸ã®æé ã§è§£é¤ãããã¨ãå¯è½ãªããã§ãã â»Apacheçããªã¼ã¦ã¨ã¢ã®ãå©ç¨ã¯ã客æ§ã®è²¬ä»»ã«ããã¦ãå©ç¨ãã確èªãã ããã ãã¹ãã¬ã¼ãºãªãã§éµãçæããå ´å é常ã®ä½ææ¹æ³ # openssl genrsa -des3 -out ./ssl.key/xxxxxxx.key 2048 â»ã-des3ãã¯ãdes3ã¢ã«ã´ãªãºã ã®ãã¹ã¯ã¼ãä¿è·ããã¨ããæå³ã§ãã ãã¹ã¯ã¼ããªãã®ä½ææ¹æ³ # openssl genrsa -out ./ssl.key/xxxxxxx.key 2048 ãã¹ãã¬ã¼ãºãå¾ãã解é¤ããå ´å å ãã¡ã¤ã«ã®ããã¯ã¢ãã # cp xxxxxxx.key xxxxxxx.key.org ãã¹ãã¬ã¼ãºã®è§£é¤ # openssl rsa -in xxxxxxx.key -out xxxxxxx.key ãã¹ãã¬ã¼ãºã
æé ã¨ãã¦ã¯æ¬¡ã®éãã openssl ãã¤ã³ã¹ãã¼ã«ã # sudo apt-get install openssl ç§å¯éµãä½ãï¼ä»®ã« server.key ã¨ãããï¼ã # sudo openssl genrsa -out server.key 4096 ï¼ãã¹ã¯ã¼ããªãã®å ´åã2048 ãã¤ãã®ãã¼ã¯å¼±ããã¦è¨¼ææ¸ã¨ãã¦ã¯ãã¯ãç¡å¹ï¼ # sudo openssl genrsa -des3 -out server.key 4096ï¼ãã¹ã¯ã¼ãããã®å ´åã2048 ãã¤ãã®ãã¼ã¯å¼±ããã¦è¨¼ææ¸ã¨ãã¦ã¯ãã¯ãç¡å¹ï¼ å ¬ééµãä½ãï¼server.csr ã¨ãããï¼ã # sudo openssl req -new -key server.key -out server.csr ç½²åä»ã®è¨¼ææ¸ãä½ãï¼server.crt ã¨ããããæå¹æéã¯ãªã¬ãªã¬ãªã®ã§ 10å¹´ãããã§ããã ãã^^ï¼ï¼
ä»ä½ã£ã¦ãããµã¼ãã¹ã¯ãApacheã®mod_proxy_balancerã使ã£ã¦ãã¼ããã©ã³ã·ã³ã°ãã¦ãããããããããã¯ã¨ã³ãã®ãµã¼ãã¹ãµã¼ããä¸æ¦è½ã¨ãã¦ãã復帰ãããã¨ãã³ãã¯ã·ã§ã³ããã°ããã¤ãªãããªãã¨ããåé¡ã«æ©ãã§ããã1åãããæ¾ç½®ããã¨ã¤ãªããããã«ãªããã ãã©ã1åã¯çµæ§é·ãã ããããããªãã®ã§ã½ã¼ã¹ãèªãã§ã¿ãã¨ãããmod_proxy_balancer.cãçºããæããap_proxy_retry_workerã¨ããé¢æ°ãã³ãã¯ã·ã§ã³ã®å確ç«ããã¦ããã®ã§ã¯ãªããã¨æãããããããé¢æ°ã®å®ç¾©ãçºãã¦ã¿ãã¨ãç¾å¨æå»ãã¨ã©ã¼çºçæå»ã¨worker->retryã足ããæ°åããã大ãããã°workerã®statusããPROXY_WORKER_IN_ERRORã®ããããä¸ããã¦ããã ãã§ãã³ãã¯ã·ã§ã³ã®ç¢ºç«ãã©ãã®ããã®ãªãã¦é¢æ°ã¯ã¾ã£ããå¼ã°ãã¦ãªããããã§ãªã«ã
ãªãªã¼ã¹ãé害æ å ±ãªã©ã®ãµã¼ãã¹ã®ãç¥ãã
ææ°ã®äººæ°ã¨ã³ããªã¼ã®é ä¿¡
å¦çãå®è¡ä¸ã§ã
j次ã®ããã¯ãã¼ã¯
kåã®ããã¯ãã¼ã¯
lãã¨ã§èªã
eã³ã¡ã³ãä¸è¦§ãéã
oãã¼ã¸ãéã
{{#tags}}- {{label}}
{{/tags}}