| Description: | Description:
The remote host is missing an update to httpd
announced via advisory FEDORA-2006-862.
The Apache HTTP Server is a powerful, full-featured, efficient, and
freely-available Web server. The Apache HTTP Server is also the
most popular Web server on the Internet.
Update Information:
This update fixes a security issue in the mod_rewrite module.
Mark Dowd of McAfee Avert Labs reported an off-by-one
security problem in the LDAP scheme handling of the
mod_rewrite module. Where RewriteEngine was enabled, and for
certain RewriteRules, this could lead to a pointer being
written out of bounds. (CVE-2006-3747)
The ability to exploit this issue is dependent on the stack
layout for a particular compiled version of mod_rewrite.
The Fedora project has analyzed Fedora Core 4 and 5 binaries
and determined that these distributions are vulnerable to
this issue. However this flaw does not affect a default
installation of Fedora Core
users who do not use, or have
not enabled, the Rewrite module are not affected by this
issue.
* Wed Jul 26 2006 Joe Orton 2.0.54-10.4
- add mod_rewrite security fix (CVE-2006-3747)
Solution: Apply the appropriate updates.
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/
This update can be installed with the 'yum' update program. Use 'yum update
package-name' at the command line. For more information, refer to 'Managing
Software with yum,' available at http://fedora.redhat.com/docs/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2006-862
Risk factor : High
CVSS Score:
7.6
|
