Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability

Bugtraq ID:	14721
Class:	Design Error
CVE:	CVE-2005-2700
Remote:	Yes
Local:	No
Published:	Sep 01 2005 12:00AM
Updated:	May 06 2008 03:35AM
Credit:	The discoverer of this issue is currently unknown.
Vulnerable:	Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 Turbolinux Turbolinux Workstation 8.0 Turbolinux Turbolinux Workstation 7.0 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux Server 8.0 Turbolinux Turbolinux Server 7.0 Turbolinux Turbolinux Desktop 10.0 Turbolinux Turbolinux 10 F... TurboLinux Personal TurboLinux Multimedia Turbolinux Home Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE Linux Enterprise Server 9 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10.0_x86 Sun Solaris 10 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux -current SGI ProPack 3.0 SP6 S.u.S.E. tomboy 10.0 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 Redhat Stronghold 4.0 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Desktop 4.0 Redhat Desktop 3.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 IBM Hardware Management Console (HMC) for pSeries 6.0 R1.0 IBM Hardware Management Console (HMC) for iSeries 6.0 R1.0 HP HP-UX B.11.23 HP HP-UX B.11.22 HP HP-UX B.11.11 HP HP-UX B.11.00 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Avaya Integrated Management 2.1 Avaya Integrated Management Avaya CVLAN Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apache Apache 2.1.7 Apache Apache 2.1.6 Apache Apache 2.1.5 Apache Apache 2.1.4 Apache Apache 2.1.3 Apache Apache 2.1.2 Apache Apache 2.1.1 Apache Apache 2.1 Apache Apache 2.0.54 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Apache Apache 2.0.53 Apache Apache 2.0.52 Apache Apache 2.0.51 Apache Apache 2.0.50 Apache Apache 2.0.49 + S.u.S.E. Linux Personal 9.1 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Apache Apache 2.0.48 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Apache Apache 2.0.47 Apache Apache 2.0.46 Apache Apache 2.0.45 Apache Apache 2.0.44 Apache Apache 2.0.43 Apache Apache 2.0.42 Apache Apache 2.0.41 Apache Apache 2.0.40 + Redhat Linux 9.0 i386 + Redhat Linux 8.0 + Terra Soft Solutions Yellow Dog Linux 3.0 Apache Apache 2.0.39 Apache Apache 2.0.38 Apache Apache 2.0.37 Apache Apache 2.0.36 Apache Apache 2.0.35 Apache Apache 2.0.32 Apache Apache 2.0.28 Beta Apache Apache 2.0.28 Apache Apache 2.0 a9 Apache Apache 2.0
Not Vulnerable:	Apache Apache 2.1.8 Apache Apache 2.0.55

Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability

Apache 2.x mod_ssl is prone to a restriction-bypass vulnerability that presents itself when mod_ssl is configured to be used with the 'SSLVerifyClient' directive.

This issue allows attackers to bypass security policies to gain access to locations that are configured to be forbidden for clients without a valid client certificate.

Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability

An exploit is not required to leverage this issue.

Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability

Solution:
Please see the attached vendor advisories for more information.


Sun Solaris 10

• Sun 122911-01
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -122911-01-1


• Sun T120543-02
  http://sunsolve.sun.com/pub-cgi/tpatchDownload.pl?dl.d,T120543-02.zip

Slackware Linux -current

• Slackware mod_ssl-2.8.24_1.3.33-i486-1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/mo d_ssl-2.8.24_1.3.33-i486-1.tgz

Apple Mac OS X 10.3.1

• Apple SecUpd2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08840&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.2

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X 10.3.3

• Apple SecUpd2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08840&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.4

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X 10.3.4

• Apple SecUpd2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08840&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.5

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.6

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.7

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X 10.3.7

• Apple SecUpd2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08840&cat= 1&platform=osx&method=sa/

Apple Mac OS X 10.3.8

• Apple SecUpd2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08840&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.8

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.3.9

• Apple SecUpdSrvr2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08841&cat= 1&platform=osx&method=sa/

Apple Mac OS X 10.3.9

• Apple SecUpd2005-009Pan.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08840&cat= 1&platform=osx&method=sa/

Apple Mac OS X Server 10.4

• Apple SecUpdSrvr2005-009Ti.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg

Apple Mac OS X 10.4

• Apple SecUpd2005-009Ti.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08835&cat= 1&platform=osx&method=sa/SecUpd2005-009Ti.dmg

Apple Mac OS X Server 10.4.1

• Apple SecUpdSrvr2005-009Ti.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg

Apple Mac OS X 10.4.2

• Apple SecUpd2005-009Ti.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08835&cat= 1&platform=osx&method=sa/SecUpd2005-009Ti.dmg

Apple Mac OS X Server 10.4.3

• Apple SecUpdSrvr2005-009Ti.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08839&cat= 1&platform=osx&method=sa/SecUpdSrvr2005-009Ti.dmg

Apple Mac OS X 10.4.3

• Apple SecUpd2005-009Ti.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty1.pl/product=08835&cat= 1&platform=osx&method=sa/SecUpd2005-009Ti.dmg

Apache Apache 2.0 a9

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.28 Beta

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.28

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.37

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.38

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.39

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.40

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz


• RedHat Fedora httpd-2.0.40-21.20.legacy.i386.rpm
  Red Hat Linux 9.0
  http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-2.0.40-21 .20.legacy.i386.rpm


• RedHat Fedora httpd-devel-2.0.40-21.20.legacy.i386.rpm
  Red Hat Linux 9.0
  http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-devel-2.0 .40-21.20.legacy.i386.rpm


• RedHat Fedora httpd-manual-2.0.40-21.20.legacy.i386.rpm
  Red Hat Linux 9.0
  http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-manual-2. 0.40-21.20.legacy.i386.rpm


• RedHat Fedora mod_ssl-2.0.40-21.20.legacy.i386.rpm
  Red Hat Linux 9.0
  http://download.fedoralegacy.org/redhat/9/updates/i386/mod_ssl-2.0.40- 21.20.legacy.i386.rpm

Apache Apache 2.0.44

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz

Apache Apache 2.0.48

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz


• Mandriva apache2-2.0.48-6.11.100mdk.amd64.rpm
  Mandrakelinux 10.0/AMD64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-2.0.48-6.11.100mdk.i586.rpm
  Mandrakelinux 10.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-2.0.48-6.11.C30mdk.i586.rpm
  Corporate 3.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-2.0.48-6.11.C30mdk.x86_64.rpm
  Corporate 3.0/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-common-2.0.48-6.11.100mdk.amd64.rpm
  Mandrakelinux 10.0/AMD64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-common-2.0.48-6.11.100mdk.i586.rpm
  Mandrakelinux 10.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-common-2.0.48-6.11.C30mdk.i586.rpm
  Corporate 3.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-common-2.0.48-6.11.C30mdk.x86_64.rpm
  Corporate 3.0/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-devel-2.0.48-6.11.100mdk.amd64.rpm
  Mandrakelinux 10.0/AMD64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-devel-2.0.48-6.11.100mdk.i586.rpm
  Mandrakelinux 10.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-manual-2.0.48-6.11.100mdk.amd64.rpm
  Mandrakelinux 10.0/AMD64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-manual-2.0.48-6.11.100mdk.i586.rpm
  Mandrakelinux 10.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-manual-2.0.48-6.11.C30mdk.i586.rpm
  Corporate 3.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-manual-2.0.48-6.11.C30mdk.x86_64.rpm
  Corporate 3.0/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_cache-2.0.48-6.11.100mdk.amd64.rpm
  Mandrakelinux 10.0/AMD64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_cache-2.0.48-6.11.100mdk.i586.rpm
  Mandrakelinux 10.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_cache-2.0.48-6.11.C30mdk.i586.rpm
  Corporate 3.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_cache-2.0.48-6.11.C30mdk.x86_64.rpm
  Corporate 3.0/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_dav-2.0.48-6.11.100mdk.amd64.rpm
  Mandrakelinux 10.0/AMD64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_dav-2.0.48-6.11.100mdk.i586.rpm
  Mandrakelinux 10.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_dav-2.0.48-6.11.C30mdk.i586.rpm
  Corporate 3.0
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_dav-2.0.48-6.11.C30mdk.x86_64.rpm
  Corporate 3.0/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• TurboLinux httpd-2.0.48-15.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/httpd-2.0.48-15.i586.rpm

Apache Apache 2.0.49

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz


• RedHat Fedora httpd-2.0.51-2.9.4.legacy.i386.rpm
  Fedora Core 2:
  http://download.fedoralegacy.org/fedora/2/updates/i386/httpd-2.0.51-2. 9.4.legacy.i386.rpm


• RedHat Fedora httpd-devel-2.0.51-2.9.4.legacy.i386.rpm
  Fedora Core 2:
  http://download.fedoralegacy.org/fedora/2/updates/i386/httpd-devel-2.0 .51-2.9.4.legacy.i386.rpm


• RedHat Fedora httpd-manual-2.0.51-2.9.4.legacy.i386.rpm
  Fedora Core 2:
  http://download.fedoralegacy.org/fedora/2/updates/i386/httpd-manual-2. 0.51-2.9.4.legacy.i386.rpm


• RedHat Fedora mod_ssl-2.0.51-2.9.4.legacy.i386.rpm
  Fedora Core 2:
  http://download.fedoralegacy.org/fedora/2/updates/i386/mod_ssl-2.0.51- 2.9.4.legacy.i386.rpm

Apache Apache 2.0.53

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz


• Mandriva apache2-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-common-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-common-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-devel-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-devel-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-manual-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-manual-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_cache-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_cache-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_dav-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_dav-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_deflate-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_deflate-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_disk_cache-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_disk_cache-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_file_cache-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_file_cache-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_ldap-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_ldap-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_mem_cache-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_mem_cache-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_proxy-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-mod_proxy-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-modules-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-modules-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-source-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-source-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-worker-2.0.53-9.2.102mdk.i586.rpm
  Mandrakelinux 10.2
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva apache2-worker-2.0.53-9.2.102mdk.x86_64.rpm
  Mandrakelinux 10.2/X86_64
  http://www1.mandrivalinux.com/en/ftp.php3


• Ubuntu apache2-common_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.53-5ubuntu5.3_amd64.deb


• Ubuntu apache2-common_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.53-5ubuntu5.3_i386.deb


• Ubuntu apache2-common_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.53-5ubuntu5.3_powerpc.deb


• Ubuntu apache2-mpm-perchild_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.53-5ubuntu5.3_amd64.deb


• Ubuntu apache2-mpm-perchild_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.53-5ubuntu5.3_i386.deb


• Ubuntu apache2-mpm-perchild_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.53-5ubuntu5.3_powerpc.deb


• Ubuntu apache2-mpm-prefork_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.53-5ubuntu5.3_amd64.deb


• Ubuntu apache2-mpm-prefork_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.53-5ubuntu5.3_i386.deb


• Ubuntu apache2-mpm-prefork_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.53-5ubuntu5.3_powerpc.deb


• Ubuntu apache2-mpm-worker_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.53-5ubuntu5.3_amd64.deb


• Ubuntu apache2-mpm-worker_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.53-5ubuntu5.3_i386.deb


• Ubuntu apache2-mpm-worker_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.53-5ubuntu5.3_powerpc.deb


• Ubuntu apache2-prefork-dev_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.53-5ubuntu5.3_amd64.deb


• Ubuntu apache2-prefork-dev_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.53-5ubuntu5.3_i386.deb


• Ubuntu apache2-prefork-dev_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.53-5ubuntu5.3_powerpc.deb


• Ubuntu apache2-threaded-dev_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.53-5ubuntu5.3_amd64.deb


• Ubuntu apache2-threaded-dev_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.53-5ubuntu5.3_i386.deb


• Ubuntu apache2-threaded-dev_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.53-5ubuntu5.3_powerpc.deb


• Ubuntu apache2_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.53-5 ubuntu5.3_amd64.deb


• Ubuntu apache2_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.53-5 ubuntu5.3_i386.deb


• Ubuntu apache2_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.53-5 ubuntu5.3_powerpc.deb


• Ubuntu libapache-mod-ssl-doc_2.8.22-1ubuntu1_all.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache-mod-ssl /libapache-mod-ssl-doc_2.8.22-1ubuntu1_all.deb


• Ubuntu libapache-mod-ssl_2.8.22-1ubuntu1_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache-mod-ssl /libapache-mod-ssl_2.8.22-1ubuntu1_amd64.deb


• Ubuntu libapache-mod-ssl_2.8.22-1ubuntu1_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache-mod-ssl /libapache-mod-ssl_2.8.22-1ubuntu1_i386.deb


• Ubuntu libapache-mod-ssl_2.8.22-1ubuntu1_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/universe/liba/libapache-mod-ssl /libapache-mod-ssl_2.8.22-1ubuntu1_powerpc.deb


• Ubuntu libapr0-dev_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 53-5ubuntu5.3_amd64.deb


• Ubuntu libapr0-dev_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 53-5ubuntu5.3_i386.deb


• Ubuntu libapr0-dev_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 53-5ubuntu5.3_powerpc.deb


• Ubuntu libapr0_2.0.53-5ubuntu5.3_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.53-5 ubuntu5.3_amd64.deb


• Ubuntu libapr0_2.0.53-5ubuntu5.3_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.53-5 ubuntu5.3_i386.deb


• Ubuntu libapr0_2.0.53-5ubuntu5.3_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.53-5 ubuntu5.3_powerpc.deb

Apache Apache 2.0.54

• Apache Software Foundation httpd-2.0.55.tar.gz
  http://www.apache.org/dist/httpd/httpd-2.0.55.tar.gz


• Trustix apache-2.0.54-14tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-2.0.55-2tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-dbm-2.0.54-14tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-dbm-2.0.55-2tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-devel-2.0.54-14tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-devel-2.0.55-2tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-html-2.0.54-14tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-html-2.0.55-2tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-manual-2.0.54-14tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-manual-2.0.55-2tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-suexec-2.0.54-14tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/


• Trustix apache-suexec-2.0.55-2tr.i586.rpm
  Trustix Secure Linux 3.0
  ftp://ftp.trustix.org/pub/trustix/updates/

Apache Apache 2.1

• Apache Software Foundation httpd-2.1.8-beta.tar.gz
  http://apache.mirrored.ca/httpd/httpd-2.1.8-beta.tar.gz

Apache Apache 2.1.1

• Apache Software Foundation httpd-2.1.8-beta.tar.gz
  http://apache.mirrored.ca/httpd/httpd-2.1.8-beta.tar.gz

Apache Apache 2.1.3

• Apache Software Foundation httpd-2.1.8-beta.tar.gz
  http://apache.mirrored.ca/httpd/httpd-2.1.8-beta.tar.gz

Apache Apache 2.1.6

• Apache Software Foundation httpd-2.1.8-beta.tar.gz
  http://apache.mirrored.ca/httpd/httpd-2.1.8-beta.tar.gz

SGI ProPack 3.0 SP6

• SGI Patch 10212
  http://support.sgi.com/

Apache Mod_SSL SSLVerifyClient Restriction Bypass Vulnerability

References:

• Announcing Apache2 and OpenSSL Security fixes for HMC (IBM)
  
• Apache 2.1 Changelog (Apache Software Foundation)
  
• Apache Homepage (Apache Software Foundation)
  
• Apache-SVN - Revision 264800 (Apache Software Foundation)
  
• ASA-2005-204 - Httpd security update (Avaya)
  
• RHSA-2005:608-7 - Important: httpd security update (RedHat)
  
• RHSA-2005:816-10 - apache, mod_ssl, php update for Stronghold (RedHat)
  
• Sun Alert ID: 102197 (Sun)
  
• Sun Alert ID: 102198 Security Vulnerabilities in the Apache 2 Web Server (Sun)