Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
BID:12519
Info
Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
| Bugtraq ID: | 12519 |
| Class: | Access Validation Error |
| CVE: |
CVE-2005-0088 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 10 2005 12:00AM |
| Updated: | Dec 07 2006 08:39PM |
| Credit: | Discovery is credited to Graham Dumpleton. |
| Vulnerable: |
Trustix Secure Linux 2.2 Trustix Secure Linux 2.1 Trustix Secure Linux 1.5 Trustix Secure Enterprise Linux 2.0 SGI ProPack 3.0 Redhat Linux 9.0 i386 Redhat Linux 7.3 i686 Redhat Linux 7.3 i386 Redhat Linux 7.3 Redhat Fedora Core1 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Desktop 3.0 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 Gregory Trubetskoy mod_python 3.1.3 Gregory Trubetskoy mod_python 3.0.4 Gregory Trubetskoy mod_python 3.0.3 Gregory Trubetskoy mod_python 3.0.2 Gregory Trubetskoy mod_python 3.0.1 Gregory Trubetskoy mod_python 3.0 Gregory Trubetskoy mod_python 2.7.10 Gregory Trubetskoy mod_python 2.7.9 Gregory Trubetskoy mod_python 2.7.8 Gregory Trubetskoy mod_python 2.7.7 Gregory Trubetskoy mod_python 2.7.6 Gregory Trubetskoy mod_python 2.7.5 Gregory Trubetskoy mod_python 2.7.4 Gregory Trubetskoy mod_python 2.7.3 Gregory Trubetskoy mod_python 2.7.2 Gregory Trubetskoy mod_python 2.7.1 Gregory Trubetskoy mod_python 2.7 |
| Not Vulnerable: | |
Discussion
Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
The mod_python module publisher handler is prone to a remote information-disclosure vulnerability. This issue may allow remote unauthorized attackers to gain access to sensitive objects.
Information obtained through the exploitation of this issue may aid attackers in launching further attacks against an affected server.
All versions of mod_python are considered vulnerable at the moment.
The mod_python module publisher handler is prone to a remote information-disclosure vulnerability. This issue may allow remote unauthorized attackers to gain access to sensitive objects.
Information obtained through the exploitation of this issue may aid attackers in launching further attacks against an affected server.
All versions of mod_python are considered vulnerable at the moment.
Exploit / POC
Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
An exploit is not required to leverage this issue.
An exploit is not required to leverage this issue.
Solution / Fix
Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
Solution:
Please see the referenced vendor advisories for details on obtaining and applying fixes.
Gregory Trubetskoy mod_python 2.7.6
Gregory Trubetskoy mod_python 2.7.8
SGI ProPack 3.0
Gregory Trubetskoy mod_python 3.0.1
Gregory Trubetskoy mod_python 3.0.3
Gregory Trubetskoy mod_python 3.0.4
Gregory Trubetskoy mod_python 3.1.3
Solution:
Please see the referenced vendor advisories for details on obtaining and applying fixes.
Gregory Trubetskoy mod_python 2.7.6
-
RedHat mod_python-2.7.8-1.7.3.3.legacy.i386.rpm
Red Hat Linux 7.3:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mod_python-2. 7.8-1.7.3.3.legacy.i386.rpm
Gregory Trubetskoy mod_python 2.7.8
-
Debian libapache-mod-python_2.7.8-0.0woody5_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_alpha.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_arm.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_hppa.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_i386.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_ia64.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_m68k.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_mips.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_mipsel.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_powerpc.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_s390.deb -
Debian libapache-mod-python_2.7.8-0.0woody5_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-python /libapache-mod-python_2.7.8-0.0woody5_sparc.deb
SGI ProPack 3.0
-
SGI Patch10144
http://support.sgi.com/
Gregory Trubetskoy mod_python 3.0.1
-
RedHat mod_python-3.0.1-4.1.legacy.i386.rpm
Red Hat Linux 9:
http://download.fedoralegacy.org/redhat/9/updates/i386/mod_python-3.0. 1-4.1.legacy.i386.rpm
Gregory Trubetskoy mod_python 3.0.3
-
RedHat mod_python-3.0.4-0.1.1.legacy.i386.rpm
Fedora Core 1:
http://download.fedoralegacy.org/fedora/1/updates/i386/mod_python-3.0. 4-0.1.1.legacy.i386.rpm
Gregory Trubetskoy mod_python 3.0.4
-
Conectiva mod_python-3.0.4-28605U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mod_python-3.0.4-28605U90_2 cl.i386.rpm -
Conectiva mod_python-doc-3.0.4-28605U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mod_python-doc-3.0.4-28605U 90_2cl.i386.rpm
Gregory Trubetskoy mod_python 3.1.3
-
Conectiva mod_python-3.1.3-51944U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mod_python-3.1.3-51944U10_ 1cl.i386.rpm -
Conectiva mod_python-doc-3.1.3-51944U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/mod_python-doc-3.1.3-51944 U10_1cl.i386.rpm -
Fedora mod_python-3.1.3-1.fc2.2.i386.rpm
RedHat Fedora Core 2
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ -
Fedora mod_python-3.1.3-1.fc2.2.x86_64.rpm
RedHat Fedora Core 2
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ -
Fedora mod_python-3.1.3-5.2.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora mod_python-3.1.3-5.2.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora mod_python-debuginfo-3.1.3-1.fc2.2.i386.rpm
RedHat Fedora Core 2
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ -
Fedora mod_python-debuginfo-3.1.3-1.fc2.2.x86_64.rpm
RedHat Fedora Core 2
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ -
Fedora mod_python-debuginfo-3.1.3-5.2.i386.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Fedora mod_python-debuginfo-3.1.3-5.2.x86_64.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
Trustix mod_python-3.1.3-2tr.i586.rpm
Trustix Secure Linux 2.2
ftp://ftp.trustix.org/pub/trustix/updates/ -
Ubuntu libapache2-mod-python-doc_3.1.3-1ubuntu3.2_all.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python /libapache2-mod-python-doc_3.1.3-1ubuntu3.2_all.deb -
Ubuntu libapache2-mod-python_3.1.3-1ubuntu3.2_all.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python /libapache2-mod-python_3.1.3-1ubuntu3.2_all.deb -
Ubuntu libapache2-mod-python2.2_3.1.3-1ubuntu3.2_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-py thon/libapache2-mod-python2.2_3.1.3-1ubuntu3.2_amd64.deb -
Ubuntu libapache2-mod-python2.2_3.1.3-1ubuntu3.2_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-py thon/libapache2-mod-python2.2_3.1.3-1ubuntu3.2_i386.deb -
Ubuntu libapache2-mod-python2.2_3.1.3-1ubuntu3.2_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache2-mod-py thon/libapache2-mod-python2.2_3.1.3-1ubuntu3.2_powerpc.deb -
Ubuntu libapache2-mod-python2.3_3.1.3-1ubuntu3.2_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python /libapache2-mod-python2.3_3.1.3-1ubuntu3.2_amd64.deb -
Ubuntu libapache2-mod-python2.3_3.1.3-1ubuntu3.2_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python /libapache2-mod-python2.3_3.1.3-1ubuntu3.2_i386.deb -
Ubuntu libapache2-mod-python2.3_3.1.3-1ubuntu3.2_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/liba/libapache2-mod-python /libapache2-mod-python2.3_3.1.3-1ubuntu3.2_powerpc.deb
References
Apache mod_python Module Publisher Handler Information Disclosure Vulnerability
References:
References:
- Apache mod_python Product Page (Apache Software Foundation)
- RHSA-2005:104-03 - Updated mod_python package fixes security issue (RedHat)