| Description: | Description:
The remote host is missing an update to apache
announced via advisory MDVSA-2008:014.
A number of vulnerabilities were found and fixed in the Apache 1.3.x
packages:
A flaw found in the mod_autoindex module could lead to a cross-site
scripting attack on sites where mod_autoindex was enabled and the
AddDefaultCharset directive was removed from the configuration,
against web browsers that did not correctly derive the response
character set following the rules in RFC 2616 (CVE-2007-4465).
A flaw found in the mod_imagemap module could lead to a cross-site
scripting attack on sites where mod_imagemap was enabled and an
imagemap file was publically available (CVE-2007-5000).
A flaw found in the mod_status module could lead to a cross-site
scripting attack on sites where mod_status was enabled and the status
pages were publically available (CVE-2007-6388).
A flaw found in the mod_proxy_ftp module could lead to a cross-site
scripting attack against web browsers which do not correctly derive
the response character set following the rules in RFC 2616, on sites
where the mod_proxy_ftp module was enabled (CVE-2008-0005).
The updated packages have been patched to correct these issues.
Affected: Corporate 3.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2008:014
Risk factor : Medium
CVSS Score:
4.3
|
