-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200409-33
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Low
     Title: Apache: Exposure of protected directories
      Date: September 24, 2004
      Bugs: #64804
        ID: 200409-33

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
A bug in the way Apache handles the Satisfy directive can lead to the
exposure of protected directories to unauthorized users.

Background
=========
The Apache HTTP server is one of most popular web servers on the
Internet.

Affected packages
================
    -------------------------------------------------------------------
     Package         /  Vulnerable  /                       Unaffected
    -------------------------------------------------------------------
  1  net-www/apache      == 2.0.51                        >= 2.0.51-r1
                                                              < 2.0.51

Description
==========
A bug in the way Apache handles the Satisfy directive, which is used to
require that certain conditions (client host, client authentication,
etc) be met before access to a certain directory is granted, could
allow the exposure of protected directories to unauthorized clients.

Impact
=====
Directories containing protected data could be exposed to all visitorsto the webserver.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All Apache users should upgrade to the latest version:

    # emerge sync

    # emerge -pv ">=net-www/apache-2.0.51-r1"
    # emerge ">=net-www/apache-2.0.51-r1"

References
=========
  [ 1 ] Apache Bug #31315
        https://bz.apache.org/bugzilla/show_bug.cgi
  [ 2 ] CAN-2004-0811
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0811

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  https://security.gentoo.org/glsa/200409-33

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org/.

License
======
Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/1.0/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iQEVAwUBQVOp/rDO2aFJ9pv2AQK24AgAiJADMeOT2uXgD3/95J2BOjPANZNFU4gJ
RS6lBrw2VuVe4urwkjPoNjlqlM/4BDY2BiXJkuCYNvKvMIm8YuYTkEtDstSKujA8
JVfSg18MeROAQqyS0sNQ9IOhr4nV3DoX60Omczp+8l3ZKtge+MUvHKiPJJPv0nuK
3cLMw7uKr/ymZatXcIDkOG1rm7K/fPMLXoVzH1aIyyDhiOspJMjku9jVm5RB9ZAe
3bK4aniPpJGpoXRIu/2kZXDI/kGTgqsCaE8ajAWU7M4mYHAheOQ0CwJguRrqVqBU
MWA1Vgn69ElQCueTD6tCznMm1RD9FxOhwoHx2Xf7H8NH6gZJc2aFMQ==jUsS
-----END PGP SIGNATURE-----