Re: apache and CAN-2003-0020

1 msg	PAM Limits
2 msg	sshd: 'Generating new 768...' ?
27 msg	Darn skiddies (ssh login attempts)
5 msg	Votre demande N° [12176-1112233143]
2 msg	bid 12877, apache mod_ssl remote DoS
3 msg	CAN-2005-0210, kernel netfilter dos memory leak
1 msg	$B$9$C$4$$2<Ce$GM6$C$A$c$*'v(B
1 msg	Wolfgang Lanzrath ist außer Haus.
1 msg	I want to be with you right now,.,..,.redemptive
51 msg	My machine was hacked - possibly via sshd?
1 msg	I want to be with you right now...continuation
1 msg	Automating security updates
7 msg	Apache 1.3.33 (from sarge) and mod_chroot
1 msg	$B;W$$$D$/$^$^$+$1$i$l$?$s$G$9!y(B
3 msg	apache and CAN-2004-0174

apache and CAN-2003-0020
\ Geoff Crompton (23 Mar 2005)
. \ Christophe Chisogne (23 Mar 2005)
. \ Joey Hess (24 Mar 2005)

1 msg	Re: Procmail recipe for Nitwit unsubscribers wh...
3 msg	Re: [DSA 694-1] New xloadimage packages fix sev...
7 msg	subscribe
5 msg	secure ident daemon

Subject:	Re: apache and CAN-2003-0020
Group:	Debian-security
From:	Joey Hess
Date:	24 Mar 2005

Geoff Crompton wrote:
> CAN-2003-0020 is a vulnerability in apache that mentions how apache
> allows escape sequences into the error logs, which might exploit a
> terminal program viewing them.
> More detail is at http://www.securityfocus.com/bid/9930. The
> securityfocus page lists Debian as being vulnerable, and I can't find a
> DSA that corresponds to CAN-2003-0020.
>
> Does anyone know if Debian is vulnerable or fixed?

CAN-2003-0020
- apache2 2.0.49
- apache 1.3.29.0.2-4

Above are the versions that contained the fixes, for unstable/testing.

--
see shy jo