|
|
| Problem Description |
A number of vulnerabilities were found and fixed in the Apache 1.3.x
packages:
A flaw found in the mod_autoindex module could lead to a cross-site
scripting attack on sites where mod_autoindex was enabled and the
AddDefaultCharset directive was removed from the configuration,
against web browsers that did not correctly derive the response
character set following the rules in RFC 2616 (CVE-2007-4465).
A flaw found in the mod_imagemap module could lead to a cross-site
scripting attack on sites where mod_imagemap was enabled and an
imagemap file was publically available (CVE-2007-5000).
A flaw found in the mod_status module could lead to a cross-site
scripting attack on sites where mod_status was enabled and the status
pages were publically available (CVE-2007-6388).
A flaw found in the mod_proxy_ftp module could lead to a cross-site
scripting attack against web browsers which do not correctly derive
the response character set following the rules in RFC 2616, on sites
where the mod_proxy_ftp module was enabled (CVE-2008-0005).
The updated packages have been patched to correct these issues.
| Updated Packages |
Corporate Server 3.0
c9c5c7f93bb0fa94835c5594bf210549 corporate/3.0/i586/apache-1.3.29-1.7.C30mdk.i586.rpm bddc9c4aad23e8601d8a836e92e8808a corporate/3.0/i586/apache-devel-1.3.29-1.7.C30mdk.i586.rpm cc176ace02cacae3749540e61e495234 corporate/3.0/i586/apache-modules-1.3.29-1.7.C30mdk.i586.rpm 9289b7b9e19b966f15eea0fe8e183d3e corporate/3.0/i586/apache-source-1.3.29-1.7.C30mdk.i586.rpm 8efcd88ed1620fc9dd2f708af8f44a07 corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm
Corporate Server 3.0/X86_64
59ca425ea89cfb2d67cccec0da61aa50 corporate/3.0/x86_64/apache-1.3.29-1.7.C30mdk.x86_64.rpm a8ff18539221b129855cf9255fe6a68c corporate/3.0/x86_64/apache-devel-1.3.29-1.7.C30mdk.x86_64.rpm 4c65bba7f8538b1d50eab4fdfc161fb4 corporate/3.0/x86_64/apache-modules-1.3.29-1.7.C30mdk.x86_64.rpm 28bb131ffe555d1e945c824a109f1724 corporate/3.0/x86_64/apache-source-1.3.29-1.7.C30mdk.x86_64.rpm 8efcd88ed1620fc9dd2f708af8f44a07 corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.