Package name
apache
Date
2008-01-16
Advisory ID
MDVSA-2008:014
Affected versions
CS3.0 i586 , CS3.0 x86_64

Problem description

A number of vulnerabilities were found and fixed in the Apache 1.3.x
packages:

A flaw found in the mod_autoindex module could lead to a cross-site
scripting attack on sites where mod_autoindex was enabled and the
AddDefaultCharset directive was removed from the configuration,
against web browsers that did not correctly derive the response
character set following the rules in RFC 2616 (CVE-2007-4465).

A flaw found in the mod_imagemap module could lead to a cross-site
scripting attack on sites where mod_imagemap was enabled and an
imagemap file was publically available (CVE-2007-5000).

A flaw found in the mod_status module could lead to a cross-site
scripting attack on sites where mod_status was enabled and the status
pages were publically available (CVE-2007-6388).

A flaw found in the mod_proxy_ftp module could lead to a cross-site
scripting attack against web browsers which do not correctly derive
the response character set following the rules in RFC 2616, on sites
where the mod_proxy_ftp module was enabled (CVE-2008-0005).

The updated packages have been patched to correct these issues.

Updated packages

CS3.0 i586

 c9c5c7f93bb0fa94835c5594bf210549  corporate/3.0/i586/apache-1.3.29-1.7.C30mdk.i586.rpm
 bddc9c4aad23e8601d8a836e92e8808a  corporate/3.0/i586/apache-devel-1.3.29-1.7.C30mdk.i586.rpm
 cc176ace02cacae3749540e61e495234  corporate/3.0/i586/apache-modules-1.3.29-1.7.C30mdk.i586.rpm
 9289b7b9e19b966f15eea0fe8e183d3e  corporate/3.0/i586/apache-source-1.3.29-1.7.C30mdk.i586.rpm 
 8efcd88ed1620fc9dd2f708af8f44a07  corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm

CS3.0 x86_64

 59ca425ea89cfb2d67cccec0da61aa50  corporate/3.0/x86_64/apache-1.3.29-1.7.C30mdk.x86_64.rpm
 a8ff18539221b129855cf9255fe6a68c  corporate/3.0/x86_64/apache-devel-1.3.29-1.7.C30mdk.x86_64.rpm
 4c65bba7f8538b1d50eab4fdfc161fb4  corporate/3.0/x86_64/apache-modules-1.3.29-1.7.C30mdk.x86_64.rpm
 28bb131ffe555d1e945c824a109f1724  corporate/3.0/x86_64/apache-source-1.3.29-1.7.C30mdk.x86_64.rpm 
 8efcd88ed1620fc9dd2f708af8f44a07  corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm

References