| Description: | Description:
The remote host is missing updates announced in
advisory CLA-2004:868.
Apache[1] is the most popular webserver in use today.
This announcement fixes the following issues with apache, mod_ssl and
mod_dav:
1. Denial of service in ap_get_mime_headers_core() function
(CVE-2004-0493[2])
The ap_get_mime_headers_core() function in Apache httpd 2.0.49 allows
remote attackers to cause a denial of service (memory exhaustion).
2. Buffer overflow in .htaccess files handler (CVE-2004-0747[3])
Buffer overflow in Apache 2.0.50 and earlier allows local attackers
to gain apache privileges via a .htaccess file that causes the buffer
overflow during expansion of environment variables.
3. Denial of service in mod_ssl (CVE-2004-0748[4])
mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause
a denial of service (CPU consumption) by aborting an SSL connection
in a way that causes an Apache child process to enter an infinite
loop.
4. Denial of service in char_buffer_read() function in mod_ssl
(CVE-2004-0751[5])
The char_buffer_read function in the mod_ssl module for Apache 2.x,
when using reverse proxying to an SSL server, allows remote attackers
to cause a denial of service (segmentation fault).
5. Denial of service in IPv6 URI parsing routines (CVE-2004-0786[6])
The IPv6 URI parsing routines in the apr-util library for Apache
2.0.50 and earlier allow remote attackers to cause a denial of
service (child process crash) via a certain URI, as demonstrated
using the Codenomicon HTTP Test Tool.
6. Denial of service in mod_dav (CVE-2004-0809[7])
The mod_dav module in Apache 2.0.50 and earlier allows remote
attackers to cause a denial of service (child process crash) via a
certain sequence of LOCK requests for a location that allows WebDAV
authoring access.
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://apache.httpd.org/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0493
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0747
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0751
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0786
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0809
http://www.securityspace.com/smysecure/catid.html?in=CLA-2004:868
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002004
Risk factor : High
CVSS Score:
6.4
|
