| Description: | Description:
The remote host is missing updates announced in
advisory CLA-2002:530.
Apache[1] is the most popular webserver in use today.
This apache update addresses three recent security vulnerabilities:
CVE-2002-0839[3]
There is a vulnerability regarding apache's use of shared memory
(SHM). An attacker which is able to execute code under the
webserver's UID is able to send arbitrary processes an USR1 signal as
root. If untreated, the default for this signal is to terminate the
process.
Via this vulnerability, the attacker is also able to cause the apache
process to continuously spawn more children, causing a local DoS.
The fix for this vulnerability introduced the ShmemUIDisUser
directive, which is documented in the apache-doc package.
CVE-2002-0840[4]
Matthew Murphy warned the apache developers about a cross site
scripting vulnerability in the standard 404 error page.
CVE-2002-0843[5]
There are some buffer overflow vulnerabilities in the ab benchmark
program included in the apache package. An attack scenario would be
that of an user running the ab tool against a web server controlled
by an attacker.
All these vulnerabilities were fixed in the just released[2] 1.3.27
version of the apache web server. The packages available through the
present update, even though they are remaining at version 1.3.26,
include fixes for these problems.
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://httpd.apache.org/
http://marc.theaimsgroup.com/?l=apache-httpd-users&m=103367270822891&w=2
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0839
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0840
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0843
http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:530
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002
Risk factor : High
CVSS Score:
7.5
|
