| Description: | Description:
The remote host is missing an update to httpd
announced via advisory FEDORA-2007-2214.
Update Information:
This update includes the latest stable release of the Apache HTTP Server.
A flaw was found in the Apache HTTP Server mod_proxy module. On
sites where a reverse proxy is configured, a remote attacker
could send a carefully crafted request that would cause the Apache
child process handling that request to crash. On sites where a
forward proxy is configured, an attacker could cause a similar
crash if a user could be persuaded to visit a malicious site using
the proxy. This could lead to a denial of service if using a
threaded Multi-Processing Module. (CVE-2007-3847)
A flaw was found in the mod_autoindex module. On sites where
directory listings are used, and the AddDefaultCharset directive
has been removed from the configuration, a cross-site-scripting
attack may be possible against browsers which do not correctly
derive the response character set following the rules in RFC 2616.
(CVE-2007-4465)
References:
[ 1 ] Bug #209605 - 500 Internal Server Error in cgi is sent with text/plain content-type (DefaultType) instead of text/html
https://bugzilla.redhat.com/show_bug.cgi?id=209605
[ 2 ] Bug #249223 - httpd install dependency missing (mailcap)
https://bugzilla.redhat.com/show_bug.cgi?id=249223
[ 3 ] Bug #250755 - CVE-2007-3847 httpd out of bounds read [F7]
https://bugzilla.redhat.com/show_bug.cgi?id=250755
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update httpd'
at the command line. For more information, refer to Managing Software
with yum, available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2007-2214
Risk factor : Medium
CVSS Score:
5.0
|
