Just picked this from solarspeed.net : Credits go entirly to Gerald Waugh and solarspeed.net.
If a download times out you may also try
http://pkg.hava.nl/RaQ4-mod_ssl-2.8.4.pkg (please note that this is just a mirror for more information see below and www.solarspeed.net)

This PKG file installs a new libssl.so Apache module which is compiled against OpenSSL-0.9.6g and which fixes this vulnerability.

Please note: Only install this PKG file on RaQ4's which have at least RaQ4-All-Security-2.0.1-15417.pkg or RaQ4-en-Security-2.0.1-SHP.pkg installed (!!!).

This PKG is fully uninstallable by running the script /var/lib/cobalt/uninstallers/mod_php-2.8.4.uninst from within SSH or Telnet as user "root"

Credits: This PKG was created based on the helpful hints which Gerald Waugh posted to the cobalt security mailing list. I just wrapped it up into a PKG file. So credits for the idea to him and flames for the sloppy package to me. :o)

Reboot Required: No
Sends registration email: No

Nice. :cool: How do you reckon this will effect the standard Cobalt upgrade path?

It won't... if/when Cobalt issues any 'official' - you can simply uninstall the pkg above :)

Brandon

You are right indeed.

Just wait for the official patch coming up in the next year or so :D
and then wait somewhat longer to see if it really works and then uninstall the above patch and install the official one.

Way to go $un/cobalt. Thanks for the quick response :mad:

Robbert

And the good news is that solarspeed are working on the Raq550 pkg as we speak!!:)

Weird... I got a message saying that the package file is corrupt.

Any thoughts?

Never mind. It does not work by pulling it directly to the server, but it works by downloading then then uploading.

It is allways good to wget the package to your box.

SSH to the server;

cd /home/packages
wget http://pkg.hava.nl/RaQ4-mod_ssl-2.8.4.pkg

and then just install it from the GUI when the download has been completed.

After that you can remove the file from the /home/packages dir because the file is not needed anymore, or keep it for archiving purposes.

HTH