Updated Apache httpd packages that correct two security issues and two bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A flaw was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

In addition, two bugs were fixed :

* when the ProxyErrorOverride directive was enabled, responses with 3xx status-codes would be overriden at the proxy. This has been changed so that only 4xx and 5xx responses are overriden.

* the 'ProxyTimeout' directive was not inherited across virtual host definitions.

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

A vulnerability was discovered in the the Apache mod_status module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled (CVE-2006-5752).

A vulnerability was found in the Apache mod_cache module that could cause the httpd server child process to crash if it was sent a carefully crafted request. This could lead to a denial of service if using a threaded MPM (CVE-2007-1863).

The Apache server also did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the server could manipulate the scoreboard and cause arbitrary processes to be terminated (CVE-2007-3304).

Updated packages have been patched to prevent the above issues.

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker who has the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated, which could lead to a denial of service. (CVE-2007-3304)

A flaw was found in the Apache HTTP Server mod_status module. Sites with the server-status page publicly accessible and ExtendedStatus enabled were vulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

Users of Apache should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

Stefan Esser discovered that mod_status did not force a character set, which could result in browsers becoming vulnerable to XSS attacks when processing the output. If a user were tricked into viewing server status output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. By default, mod_status is disabled in Ubuntu. (CVE-2006-5752)

Niklas Edmundsson discovered that the mod_cache module could be made to crash using a specially crafted request. A remote user could use this to cause a denial of service if Apache was configured to use a threaded worker. By default, mod_cache is disabled in Ubuntu.
(CVE-2007-1863)

A flaw was discovered in the signal handling of Apache. A local attacker could trick Apache into sending SIGUSR1 to other processes.
The vulnerable code was only present in Ubuntu Feisty. (CVE-2007-3304).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Red Hat Network Proxy Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The Red Hat Network Proxy Server 4.2.3 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752, CVE-2006-3918, CVE-2005-3352)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
25613	CentOS 3 : httpd (CESA-2007:0533)	Nessus	CentOS Local Security Checks	2007/6/29	2021/1/4	medium
25670	Mandrake Linux Security Advisory : apache (MDKSA-2007:140)	Nessus	Mandriva Local Security Checks	2007/7/5	2021/1/6	medium
25608	RHEL 2.1 : apache (RHSA-2007:0532)	Nessus	Red Hat Local Security Checks	2007/6/27	2021/1/14	medium
28102	Ubuntu 6.06 LTS / 6.10 / 7.04 : apache2 vulnerabilities (USN-499-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
63857	RHEL 3 / 4 : Proxy Server (RHSA-2008:0523)	Nessus	Red Hat Local Security Checks	2013/1/24	2021/1/14	high

检测

插件搜索

medium

medium

medium

medium

high