| Beschreibung: | Description:
The remote host is missing updates announced in
advisory RHSA-2008:0966.
The Red Hat Application Stack v2.2 is an integrated open source application
stack, that includes Red Hat Enterprise Linux 5 and JBoss Enterprise
Application Platform (EAP) 4.2.
This erratum updates the Apache HTTP Server package to version 2.0.10 which
addresses the following security issues:
A flaw was found in the mod_proxy module. An attacker who has control of
a web server to which requests are being proxied could cause a limited
denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)
A flaw was found in the mod_proxy_ftp module. Where Apache is configured
to support ftp-over-httpd proxying, a remote attacker could perform a
cross-site scripting attack. (CVE-2008-2939)
A cross-site request forgery issue was found in the mod_proxy_balancer
module. A remote attacker could cause a denial of service if
mod_proxy_balancer is enabled and an authenticated user is targeted.
(CVE-2007-6420)
The JBoss Enterprise Application Platform (EAP) 4.2 has been updated to
version 4.2.0.CP05.
The following packages were also updated:
* mysql to 5.0.60sp1
* mysql-connector-odbc to 3.51.26r1127
* perl-DBI to 1.607
* perl-DBD-MySQL to 4.008
* perl-DBD-Pg to 1.49
* php-pear to 1.7.2
* postgresql to 8.2.11
* postgresqlclient81 to 8.1.11
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2008-0966.html
http://www.redhat.com/security/updates/classification/#moderate
Risk factor : Medium
CVSS Score:
5.0
|
