| Description: | Description:
The remote host is missing an update to httpd
announced via advisory FEDORA-2008-1695.
The Apache HTTP Server is a powerful, efficient, and extensible
web server.
Update Information:
This update includes the latest release of httpd 2.2, which fixes a number of
minor security issues and other bugs.
A flaw was found in the mod_imagemap module. On sites where mod_imagemap
was enabled and an imagemap file was publicly available, a cross-site
scripting attack was possible. (CVE-2007-5000)
A flaw was found in the mod_status module. On sites where
mod_status was enabled and the status pages were publicly
accessible, a cross-site scripting attack was possible. (CVE-2007-6388)
A flaw was found in the mod_proxy_balancer module. On sites where
mod_proxy_balancer was enabled, a cross-site scripting attack against
an authorized user was possible. (CVE-2007-6421)
A flaw was found in the mod_proxy_balancer module. On sites
where mod_proxy_balancer was enabled, an authorized user
could send a carefully crafted request that would cause the
Apache child process handling that request to crash. This could
lead to a denial of service if using a threaded Multi-Processing Module.
(CVE-2007-6422)
A flaw was found in the mod_proxy_ftp module. On sites where
mod_proxy_ftp was enabled and a forward proxy was configured,
a cross-site scripting attack was possible against browsers which
do not correctly derive the response character set following
the rules in RFC 2616. (CVE-2008-0005)
References:
[ 1 ] Bug #427228 - CVE-2007-6388 apache mod_status cross-site scripting
https://bugzilla.redhat.com/show_bug.cgi?id=427228
[ 2 ] Bug #427229 - CVE-2007-6421 httpd mod_proxy_balancer cross-site scripting
https://bugzilla.redhat.com/show_bug.cgi?id=427229
[ 3 ] Bug #427739 - CVE-2008-0005 mod_proxy_ftp XSS
https://bugzilla.redhat.com/show_bug.cgi?id=427739
[ 4 ] Bug #419931 - CVE-2007-5000 mod_imagemap XSS
https://bugzilla.redhat.com/show_bug.cgi?id=419931
[ 5 ] Bug #427230 - CVE-2007-6422 httpd mod_proxy_balancer crash
https://bugzilla.redhat.com/show_bug.cgi?id=427230
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update httpd' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2008-1695
Risk factor : Medium
CVSS Score:
4.3
|
