Synopsis

mod_auth_pgsql security update

Type/Severity

Security Advisory: Critical

Topic

Updated mod_auth_pgsql packages that fix format string security issues are
now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

The mod_auth_pgsql package is an httpd module that allows user
authentication against information stored in a PostgreSQL database.

Several format string flaws were found in the way mod_auth_pgsql logs
information. It may be possible for a remote attacker to execute arbitrary
code as the 'apache' user if mod_auth_pgsql is used for user
authentication. The Common Vulnerabilities and Exposures project assigned
the name CVE-2005-3656 to this issue.

Please note that this issue only affects servers which have mod_auth_pgsql
installed and configured to perform user authentication against a
PostgreSQL database.

All users of mod_auth_pgsql should upgrade to these updated packages, which
contain a backported patch to resolve this issue.

This issue does not affect the mod_auth_pgsql package supplied with Red Hat
Enterprise Linux 2.1.

Red Hat would like to thank iDefense for reporting this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 177042 - CVE-2005-3656 mod_auth_pgsql format string issue

CVEs

• CVE-2005-3656

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
mod_auth_pgsql-2.0.1-7.1.src.rpm	SHA-256: 7b972e5071410af981b865114fd31fcdebab10f3fbfe640469ea952635ce2a9c
x86_64
mod_auth_pgsql-2.0.1-7.1.x86_64.rpm	SHA-256: c36d646e870eeb064dff093cef9266480cf94d23b36fcc64755853222d103256
mod_auth_pgsql-2.0.1-7.1.x86_64.rpm	SHA-256: c36d646e870eeb064dff093cef9266480cf94d23b36fcc64755853222d103256
ia64
mod_auth_pgsql-2.0.1-7.1.ia64.rpm	SHA-256: b601d46c29c3505ea300ea635705c1e017c128ccc3533a77c6ade2f2c988071c
mod_auth_pgsql-2.0.1-7.1.ia64.rpm	SHA-256: b601d46c29c3505ea300ea635705c1e017c128ccc3533a77c6ade2f2c988071c
i386
mod_auth_pgsql-2.0.1-7.1.i386.rpm	SHA-256: e6ea09cd9c0eaef3806eb454728cf8004c9fdd380a8b823360cb393f12a0f817
mod_auth_pgsql-2.0.1-7.1.i386.rpm	SHA-256: e6ea09cd9c0eaef3806eb454728cf8004c9fdd380a8b823360cb393f12a0f817

Red Hat Enterprise Linux Workstation 4

SRPM
mod_auth_pgsql-2.0.1-7.1.src.rpm	SHA-256: 7b972e5071410af981b865114fd31fcdebab10f3fbfe640469ea952635ce2a9c
x86_64
mod_auth_pgsql-2.0.1-7.1.x86_64.rpm	SHA-256: c36d646e870eeb064dff093cef9266480cf94d23b36fcc64755853222d103256
ia64
mod_auth_pgsql-2.0.1-7.1.ia64.rpm	SHA-256: b601d46c29c3505ea300ea635705c1e017c128ccc3533a77c6ade2f2c988071c
i386
mod_auth_pgsql-2.0.1-7.1.i386.rpm	SHA-256: e6ea09cd9c0eaef3806eb454728cf8004c9fdd380a8b823360cb393f12a0f817

Red Hat Enterprise Linux Desktop 4

SRPM
mod_auth_pgsql-2.0.1-7.1.src.rpm	SHA-256: 7b972e5071410af981b865114fd31fcdebab10f3fbfe640469ea952635ce2a9c
x86_64
mod_auth_pgsql-2.0.1-7.1.x86_64.rpm	SHA-256: c36d646e870eeb064dff093cef9266480cf94d23b36fcc64755853222d103256
i386
mod_auth_pgsql-2.0.1-7.1.i386.rpm	SHA-256: e6ea09cd9c0eaef3806eb454728cf8004c9fdd380a8b823360cb393f12a0f817

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
mod_auth_pgsql-2.0.1-7.1.src.rpm	SHA-256: 7b972e5071410af981b865114fd31fcdebab10f3fbfe640469ea952635ce2a9c
s390x
mod_auth_pgsql-2.0.1-7.1.s390x.rpm	SHA-256: 91c77a879e6e7e2049be9313edb8f03b1ea61682fbc083c9a664cef7932e20cf
s390
mod_auth_pgsql-2.0.1-7.1.s390.rpm	SHA-256: 68f22992a11bfb13927fd37d86713f8daf51115f8d257421a028503ce21bc76a

Red Hat Enterprise Linux for Power, big endian 4

SRPM
mod_auth_pgsql-2.0.1-7.1.src.rpm	SHA-256: 7b972e5071410af981b865114fd31fcdebab10f3fbfe640469ea952635ce2a9c
ppc
mod_auth_pgsql-2.0.1-7.1.ppc.rpm	SHA-256: ea920fbe1d8266a502a8fde4d006bf554f2f057b27058fd9a560df4c0c720368