| Description: | Summary:
The remote host is missing an update for the 'httpd' package(s) announced via the SSA:2009-214-01 advisory.
Vulnerability Insight:
New httpd packages are available for Slackware 12.0, 12.1, 12.2, and -current
to fix security issues.
More details about these issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[links moved to references]
Here are the details from the Slackware 12.2 ChangeLog:
+--------------------------+
patches/packages/httpd-2.2.12-i486-1_slack12.2.tgz: Upgraded.
This update fixes some security issues (from the CHANGES file):
*) SECURITY: CVE-2009-1891 (cve.mitre.org)
Fix a potential Denial-of-Service attack against mod_deflate or other
modules, by forcing the server to consume CPU time in compressing a
large file after a client disconnects. PR 39605.
[Joe Orton, Ruediger Pluem]
*) SECURITY: CVE-2009-1195 (cve.mitre.org)
Prevent the 'Includes' Option from being enabled in an .htaccess
file if the AllowOverride restrictions do not permit it.
[Jonathan Peatfield , Joe Orton,
Ruediger Pluem, Jeff Trawick]
*) SECURITY: CVE-2009-1890 (cve.mitre.org)
Fix a potential Denial-of-Service attack against mod_proxy in a
reverse proxy configuration, where a remote attacker can force a
proxy process to consume CPU time indefinitely. [Nick Kew, Joe Orton]
*) SECURITY: CVE-2009-1191 (cve.mitre.org)
mod_proxy_ajp: Avoid delivering content from a previous request which
failed to send a request body. PR 46949 [Ruediger Pluem]
*) SECURITY: CVE-2009-0023, CVE-2009-1955, CVE-2009-1956 (cve.mitre.org)
The bundled copy of the APR-util library has been updated, fixing three
different security issues which may affect particular configurations
and third-party modules.
These last three CVEs were addressed in Slackware previously with an
update to new system apr and apr-util packages.
For more information, see:
[links moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'httpd' package(s) on Slackware 12.0, Slackware 12.1, Slackware 12.2, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
7.1
CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:N/A:C
|
