| Description: | Description:
The remote host is missing an update to apache2
announced via advisory MDKSA-2004:096.
Two Denial of Service conditions were discovered in the input filter
of mod_ssl, the module that enables apache to handle HTTPS requests.
Another vulnerability was discovered by the ASF security team using
the Codenomicon HTTP Test Tool. This vulnerability, in the apr-util
library, can possibly lead to arbitray code execution if certain
non-default conditions are met (enabling the AP_ENABLE_EXCEPTION_HOOK
define).
As well, the SITIC have discovered a buffer overflow when Apache
expands environment variables in configuration files such as .htaccess
and httpd.conf, which can lead to possible privilege escalation. This
can only be done, however, if an attacker is able to place malicious
configuration files on the server.
Finally, a crash condition was discovered in the mod_dav module by
Julian Reschke, where sending a LOCK refresh request to an indirectly
locked resource could crash the server.
The updated packages have been patched to protect against these
vulnerabilities.
Affected versions: 10.0, 9.2
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2004:096
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0747
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0751
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0786
http://www.uniras.gov.uk/vuls/2004/403518/index.htm
Risk factor : Medium
CVSS Score:
5.0
|
