| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2004:342.
The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.
A stack buffer overflow was discovered in mod_ssl that could be triggered
if using the FakeBasicAuth option. If mod_ssl was sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow
occured if FakeBasicAuth had been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have had to be signed by
a Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-0488 to this issue.
A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0493 to this issue.
Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2004-342.html
http://www.apacheweek.com/features/security-20
Risk factor : High
CVSS Score:
7.5
|
