Test ID:	1.3.6.1.4.1.25623.1.0.50888
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2001:077 (apache)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to apache announced via advisory MDKSA-2001:077. A problem exists with all Apache servers prior to version 1.3.19. The vulnerablity could allow directory indexing and path discovery on the vulnerable servers with a custom crafted request consisting of a long path name created artificially by using numerous slashes. This can cause modules to misbehave and return a listing of the directory contents by avoiding the error page. Because of the number of add-on packages Mandrake Linux provides for Apache that are compiled for a specific version of Apache, and due to the complexity of the upgrade, we recommend that users upgrade Apache and all associated packages by hand, invoking RPM directly. The updates provide updated Apache, PHP, mod_perl, and mod_ssl packages for all relevant versions, and all should be upgraded at the same time to avoid dependency issues. You can do this by using the rpm -Fvh *.rpm command from a temporary directory containing the relevant update packages. Due to a packaging error in previous versions of mod_php3 for Linux- Mandrake 7.1, you will need to manually edit /etc/httpd.conf to re- enable PHP support. You can do this by issuing, as root: echo Include conf/addon-modules/php.conf >>/etc/httpd/conf/httpd.conf Additionally, we have updated PHP to version 4.0.6 for Mandrake Linux 8.0. Affected versions: 7.1, 7.2, 8.0, Corporate Server 1.0.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2001:077 http://www.securityfocus.com/vdb/bottom.html?vid=2503 http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.