Test ID:	1.3.6.1.4.1.25623.1.0.63083
Category:	Turbolinux Local Security Tests
Title:	Turbolinux TLSA-2008-5 (httpd)
Summary:	Turbolinux TLSA-2008-5 (httpd)
Description:	The remote host is missing an update to httpd announced via advisory TLSA-2008-5. Apache is a powerful, full-featured, efficient, and freely-available Web server. Apache is also the most popular Web server on the Internet. The Multiple cross-site scripting vulnerabilities exist in httpd. This vulnerabilities can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Solution: Please use the turbopkg (zabom) tool to apply the update. http://www.securityspace.com/smysecure/catid.html?in=TLSA-2008-5 Risk factor : Medium
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-4465 Bugtraq: 20070912 Apache2 Undefined Charset UTF-7 XSS Vulnerability (Google Search) http://www.securityfocus.com/archive/1/archive/1/479237/100/0/threaded http://securityreason.com/achievement_securityalert/46 http://lists.apple.com/archives/security-announce/2008//May/msg00001.html http://www.redhat.com/archives/fedora-package-announce/2007-September/msg00320.html https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00353.html http://security.gentoo.org/glsa/glsa-200711-06.xml HPdes Security Advisory: HPSBUX02365 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432 HPdes Security Advisory: SSRT080118 HPdes Security Advisory: HPSBUX02431 http://marc.info/?l=bugtraq&m=124654546101607&w=2 HPdes Security Advisory: SSRT090085 HPdes Security Advisory: HPSBUX02465 http://marc.info/?l=bugtraq&m=125631037611762&w=2 HPdes Security Advisory: SSRT090192 http://www.mandriva.com/security/advisories?name=MDVSA-2008:014 http://www.redhat.com/support/errata/RHSA-2007-0911.html http://www.redhat.com/support/errata/RHSA-2008-0004.html http://www.redhat.com/support/errata/RHSA-2008-0005.html http://www.redhat.com/support/errata/RHSA-2008-0006.html http://www.redhat.com/support/errata/RHSA-2008-0008.html http://www.redhat.com/support/errata/RHSA-2008-0261.html SuSE Security Announcement: SUSE-SA:2007:061 (Google Search) http://www.novell.com/linux/security/advisories/2007_61_apache2.html http://www.ubuntu.com/usn/usn-575-1 Cert/CC Advisory: TA08-150A http://www.us-cert.gov/cas/techalerts/TA08-150A.html BugTraq ID: 25653 http://www.securityfocus.com/bid/25653 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6089 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10929 http://secunia.com/advisories/35650 http://www.vupen.com/english/advisories/2008/1697 http://securitytracker.com/id?1019194 http://secunia.com/advisories/26842 http://secunia.com/advisories/26952 http://secunia.com/advisories/27563 http://secunia.com/advisories/27732 http://secunia.com/advisories/28467 http://secunia.com/advisories/28471 http://secunia.com/advisories/28607 http://secunia.com/advisories/28749 http://secunia.com/advisories/30430 http://secunia.com/advisories/31651 http://secunia.com/advisories/33105 http://securityreason.com/securityalert/3113 XForce ISS Database: apache-utf7-xss(36586) http://xforce.iss.net/xforce/xfdb/36586 Common Vulnerability Exposure (CVE) ID: CVE-2007-6388 Bugtraq: 20080716 rPSA-2008-0035-1 httpd mod_ssl (Google Search) http://www.securityfocus.com/archive/1/archive/1/494428/100/0/threaded Bugtraq: 20090821 VMSA-2009-0010 VMware Hosted products update libpng and Apache HTTP Server (Google Search) http://www.securityfocus.com/archive/1/archive/1/505990/100/0/threaded http://lists.vmware.com/pipermail/security-announce/2009/000062.html AIX APAR: PK59667 http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only AIX APAR: PK62966 http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966 AIX APAR: PK63273 http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273 AIX APAR: PK65782 http://www-1.ibm.com/support/docview.wss?uid=swg24019245 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html HPdes Security Advisory: HPSBUX02313 http://www.securityfocus.com/archive/1/archive/1/488082/100/0/threaded HPdes Security Advisory: SSRT080015 HPdes Security Advisory: HPSBMA02388 http://www.securityfocus.com/archive/1/archive/1/498523/100/0/threaded HPdes Security Advisory: SSRT080059 HPdes Security Advisory: HPSBOV02683 http://marc.info/?l=bugtraq&m=130497311408250&w=2 HPdes Security Advisory: SSRT090208 http://www.mandriva.com/security/advisories?name=MDVSA-2008:015 http://www.mandriva.com/security/advisories?name=MDVSA-2008:016 http://www.redhat.com/support/errata/RHSA-2008-0007.html http://www.redhat.com/support/errata/RHSA-2008-0009.html http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748 http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1 SuSE Security Announcement: SUSE-SA:2008:021 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html BugTraq ID: 27237 http://www.securityfocus.com/bid/27237 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10272 http://secunia.com/advisories/32800 http://www.vupen.com/english/advisories/2008/0047 http://www.vupen.com/english/advisories/2008/0447/references http://www.vupen.com/english/advisories/2008/0554 http://www.vupen.com/english/advisories/2008/0809/references http://www.vupen.com/english/advisories/2008/0924/references http://www.vupen.com/english/advisories/2008/0986/references http://www.vupen.com/english/advisories/2008/1224/references http://www.vupen.com/english/advisories/2008/1623/references http://securitytracker.com/id?1019154 http://secunia.com/advisories/28526 http://secunia.com/advisories/28965 http://secunia.com/advisories/28977 http://secunia.com/advisories/28922 http://secunia.com/advisories/29420 http://secunia.com/advisories/29504 http://secunia.com/advisories/29640 http://secunia.com/advisories/29806 http://secunia.com/advisories/29988 http://secunia.com/advisories/30356 http://secunia.com/advisories/31142 http://secunia.com/advisories/30732 http://secunia.com/advisories/33200 http://securityreason.com/securityalert/3541 XForce ISS Database: apache-status-page-xss(39472) http://xforce.iss.net/xforce/xfdb/39472 Common Vulnerability Exposure (CVE) ID: CVE-2007-6421 Bugtraq: 20080110 SecurityReason - Apache2 CSRF, XSS, Memory Corruption and Denial of Service Vulnerability (Google Search) http://www.securityfocus.com/archive/1/archive/1/486169/100/0/threaded BugTraq ID: 27236 http://www.securityfocus.com/bid/27236 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10664 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8651 http://www.vupen.com/english/advisories/2008/0048 http://securityreason.com/securityalert/3523 XForce ISS Database: apache-modproxybalancer-xss(39474) http://xforce.iss.net/xforce/xfdb/39474 Common Vulnerability Exposure (CVE) ID: CVE-2007-6422 http://security.gentoo.org/glsa/glsa-200803-19.xml http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10181 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8690 http://secunia.com/advisories/29348 XForce ISS Database: apache-modproxybalancer-dos(39476) http://xforce.iss.net/xforce/xfdb/39476 Common Vulnerability Exposure (CVE) ID: CVE-2008-0005 http://securityreason.com/achievement_securityalert/49 Bugtraq: 20080110 SecurityReason - Apache (mod_proxy_ftp) Undefined Charset UTF-7 XSS Vulnerability (Google Search) http://www.securityfocus.com/archive/1/archive/1/486167/100/0/threaded BugTraq ID: 27234 http://www.securityfocus.com/bid/27234 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10812 http://www.vupen.com/english/advisories/2008/1875/references http://www.securitytracker.com/id?1019185 http://securityreason.com/securityalert/3526 XForce ISS Database: apache-modproxyftp-utf7-xss(39615) http://xforce.iss.net/xforce/xfdb/39615
Copyright	Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: