Vulnerability ?

This is a MIME message. If you are reading this text, you may want to
consider changing to a mail reader or gateway that understands how to
properly handle MIME multipart messages.

--=__Part68432E3C.0__=
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

Hi,
=20
We have received the following vulnerability report:
http://www.securityfocus.com/bid/23192/info
=20
I read the changes for the mod_perl versions but did not find anything =
really clear. We are using mod_perl version 2.0.3 compiled for Suse linux =
enterprise server 10 sp2 used with apache 2.0.x compiled also (we are not =
using rpm versions of these packages).
=20
Can somebody clarify if the vulnerability still present in version 2.0.3 =
and if we are obliged to move to version 2.0.4 ?
=20
Many thanks in advance
=20
Francois

--=__Part68432E3C.0__=
Content-Type: text/html; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Description: HTML


">

Re: Vulnerability ?

--000e0cd2457adbb41104693d8630
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

On Wed, May 6, 2009 at 7:40 AM, Francois Pernet wrote:

> Hi,
>
> We have received the following vulnerability report:
> http://www.securityfocus.com/bid/23192/info
>
> I read the changes for the mod_perl versions but did not find anything
> really clear. We are using mod_perl version 2.0.3 compiled for Suse linux
> enterprise server 10 sp2 used with apache 2.0.x compiled also (we are not
> using rpm versions of these packages).
>
> Can somebody clarify if the vulnerability still present in version 2.0.3
> and if we are obliged to move to version 2.0.4 ?
>

As listed on that securityfocus page, the CVE number is CVE-2007-1349.
Checking the Changes files for 2.0.3 and 2.0.4, you'll see that 2.0.4 has a
fix for that CVE but 2.0.3 doesn't. So 2.0.3 is vulnerable.

--000e0cd2457adbb41104693d8630
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Re: Vulnerability ?

For mod_perl 2 users, this only affects you if you use
ModPerl::PerlRun or ModPerl::Registry.

- Perrin

On Wed, May 6, 2009 at 7:40 AM, Francois Pernet wrote:
> Hi,
>
> We have received the following vulnerability report:
> http://www.securityfocus.com/bid/23192/info
>
> I read the changes for the mod_perl versions but did not find anything
> really clear. We are using mod_perl version 2.0.3 compiled for Suse linux
> enterprise server 10 sp2 used with apache 2.0.x compiled also (we are not
> using rpm versions of these packages).
>
> Can somebody clarify if the vulnerability still present in version 2.0.3 and
> if we are obliged to move to version 2.0.4 ?
>
> Many thanks in advance
>
> Francois