| Description: | Description:
The remote host is missing an update to apache2
announced via advisory USN-160-1.
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
apache2-mpm-perchild
apache2-mpm-prefork
apache2-mpm-threadpool
apache2-mpm-worker
Marc Stern discovered a buffer overflow in the SSL module's
certificate revocation list (CRL) handler. If Apache is configured to
use a malicious CRL, this could possibly lead to a server crash or
arbitrary code execution with the privileges of the Apache web server.
(CVE-2005-1268)
Watchfire discovered that Apache insufficiently verified the
Transfer-Encoding and Content-Length headers when acting as an
HTTP proxy. By sending a specially crafted HTTP request, a remote
attacker who is authorized to use the proxy could exploit this to
bypass web application firewalls, poison the HTTP proxy cache, and
conduct cross-site scripting attacks against other proxy users.
(CVE-2005-2088)
Solution:
The problem can be corrected by upgrading the affected package to
version 2.0.50-12ubuntu4.3 (for Ubuntu 4.10), or 2.0.53-5ubuntu5.2
(for Ubuntu 5.04). In general, a standard system upgrade is
sufficient to effect the necessary changes.
http://www.securityspace.com/smysecure/catid.html?in=USN-160-1
Risk factor : Medium
CVSS Score:
5.0
|
