Test ID:	1.3.6.1.4.1.25623.1.0.67446
Category:	Fedora Local Security Checks
Title:	Fedora Core 13 FEDORA-2010-7599 (boa)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to boa announced via advisory FEDORA-2010-7599. Boa is a single-tasking HTTP server. That means that unlike traditional web servers, it does not fork for each incoming connection, nor does it fork many copies of itself to handle multiple connections. It internally multiplexes all of the ongoing HTTP connections, and forks only for CGI programs (which must be separate processes), automatic directory generation, and automatic file gunzipping. The primary design goals of Boa are speed and security. Security, in the sense of can't be subverted by a malicious user, not fine grained access control and encrypted communications. Boa is not intended as a feature-packed server. Available rpmbuild rebuild options : --with : debug access poll --without : gunzip sendfile Update Information: This update fixes CVE-2009-4496 where HTTP request logs were written without sanitizing non-printable characters. References: [ 1 ] Bug #583162 - CVE-2009-4496 boa: sanitize nonprintable characters in error logs https://bugzilla.redhat.com/show_bug.cgi?id=583162 Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update boa' at the command line. For more information, refer to Managing Software with yum, available at http://docs.fedoraproject.org/yum/. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2010-7599 Risk factor : Medium CVSS Score: 5.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4496 BugTraq ID: 37718 http://www.securityfocus.com/bid/37718 Bugtraq: 20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection (Google Search) http://www.securityfocus.com/archive/1/508830/100/0/threaded http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041285.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041271.html http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041274.html http://www.ush.it/team/ush/hack_httpd_escape/adv.txt http://secunia.com/advisories/39775 http://www.vupen.com/english/advisories/2010/1133
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.