| Beschreibung: | Summary:
The remote host is missing an update for the 'Apache' package(s) announced via the SSA:2006-209-01 advisory.
Vulnerability Insight:
New Apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,
10.2, and -current to fix a security issue with mod_rewrite.
More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[link moved to references]
In addition, new mod_ssl packages for Apache 1.3.37 are available for
all of these versions of Slackware. This additional package does not
fix a security issue, but may be required on your system depending on
your Apache setup.
Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/apache-1.3.37-i486-1_slack10.2.tgz:
Upgraded to apache-1.3.37.
From the announcement on httpd.apache.org:
This version of Apache is security fix release only. An off-by-one flaw
exists in the Rewrite module, mod_rewrite, as shipped with Apache 1.3
since 1.3.28, 2.0 since 2.0.46, and 2.2 since 2.2.0.
The Slackware Security Team feels that the vast majority of installations
will not be configured in a vulnerable way but still suggests upgrading to
the new apache and mod_ssl packages for maximum security.
For more details, see:
[link moved to references]
And see Apache's announcement here:
[link moved to references]
(* Security fix *)
patches/packages/mod_ssl-2.8.28_1.3.37-i486-1_slack10.2.tgz:
Upgraded to mod_ssl-2.8.28-1.3.37.
+--------------------------+
Affected Software/OS:
'Apache' package(s) on Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1, Slackware 10.2, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
7.6
CVSS Vector:
AV:N/AC:H/Au:N/C:C/I:C/A:C
|
