| Description: | Summary:
The remote host is missing an update for the 'httpd' package(s) announced via the SSA:2010-067-01 advisory.
Vulnerability Insight:
New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0,
and -current to fix security issues.
mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
by rejecting any client-initiated renegotiations.
mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent
when request headers indicate a request body is incoming, not a case of
HTTP_INTERNAL_SERVER_ERROR.
mod_isapi: Do not unload an isapi .dll module until the request processing
is completed, avoiding orphaned callback pointers.
[This is the most serious flaw, but does not affect Linux systems]
More details about these issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
[links moved to references]
Here are the details from the Slackware 13.0 ChangeLog:
+--------------------------+
patches/packages/httpd-2.2.15-i486-1_slack13.0.txz: Upgraded.
This update addresses a few security issues.
mod_ssl: A partial fix for the TLS renegotiation prefix injection attack
by rejecting any client-initiated renegotiations.
mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent
when request headers indicate a request body is incoming, not a case of
HTTP_INTERNAL_SERVER_ERROR.
mod_isapi: Do not unload an isapi .dll module until the request processing
is completed, avoiding orphaned callback pointers.
[This is the most serious flaw, but does not affect Linux systems]
For more information, see:
[links moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'httpd' package(s) on Slackware 12.0, Slackware 12.1, Slackware 12.2, Slackware 13.0, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
