| Description: | Description:
The remote host is missing an update to httpd
announced via advisory FEDORA-2006-863.
The Apache HTTP Server is a powerful, efficient, and extensible
web server.
Update Information:
This update fixes a security issue in the mod_rewrite module.
Mark Dowd of McAfee Avert Labs reported an off-by-one
security problem in the LDAP scheme handling of the
mod_rewrite module. Where RewriteEngine was enabled, and for
certain RewriteRules, this could lead to a pointer being
written out of bounds. (CVE-2006-3747)
The ability to exploit this issue is dependent on the stack
layout for a particular compiled version of mod_rewrite.
The Fedora project has analyzed Fedora Core 4 and 5 binaries
and determined that these distributions are vulnerable to
this issue. However this flaw does not affect a default
installation of Fedora Core
users who do not use, or have
not enabled, the Rewrite module are not affected by this
issue.
* Wed Jul 26 2006 Joe Orton 2.2.2-1.2
- add mod_rewrite security fix (CVE-2006-3747)
* Wed Jul 19 2006 Joe Orton 2.2.2-1.1
- fix segfault on dummy connection failure at graceful restart (#199429)
* Thu May 11 2006 Joe Orton 2.2.2-1.0
- update to 2.2.2
* Thu Apr 6 2006 Joe Orton 2.2.0-5.2
- fix LDAP issues on 64-bit platforms (#188073)
Solution: Apply the appropriate updates.
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/
This update can be installed with the 'yum' update program. Use 'yum update
package-name' at the command line. For more information, refer to 'Managing
Software with yum,' available at http://fedora.redhat.com/docs/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2006-863
Risk factor : High
CVSS Score:
7.6
|
