Issued:
2008-01-15
Updated:
2008-01-15

RHSA-2008:0006 - Security Advisory

Synopsis

Moderate: httpd security update

Type/Severity

Security Advisory: Moderate

Topic

Updated Apache httpd packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The Apache HTTP Server is a popular Web server.

A flaw was found in the mod_imap module. On sites where mod_imap was
enabled and an imagemap file was publicly available, a cross-site scripting
attack was possible. (CVE-2007-5000)

A flaw was found in the mod_autoindex module. On sites where directory
listings are used, and the "AddDefaultCharset" directive has been removed
from the configuration, a cross-site scripting attack was possible against
Web browsers which do not correctly derive the response character set
following the rules in RFC 2616. (CVE-2007-4465)

A flaw was found in the mod_status module. On sites where mod_status was
enabled and the status pages were publicly available, a cross-site
scripting attack was possible. (CVE-2007-6388)

A flaw was found in the mod_proxy_ftp module. On sites where mod_proxy_ftp
was enabled and a forward proxy was configured, a cross-site scripting
attack was possible against Web browsers which do not correctly derive the
response character set following the rules in RFC 2616. (CVE-2008-0005)

Users of Apache httpd should upgrade to these updated packages, which
contain backported patches to resolve these issues. Users should restart
httpd after installing this update.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 4.6 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.6 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.6 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.6 ppc

Fixes

CVEs

References

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390
httpd-2.0.52-38.ent.2.s390.rpm SHA-256: ac68a5f83b9e2ba372f6ad32536aa076f5401e67cf85756cead148a7f3f81dca
httpd-devel-2.0.52-38.ent.2.s390.rpm SHA-256: da3554c008a6b85754295a212660098406b193904d55f76ea585a7e57b4eb339
httpd-manual-2.0.52-38.ent.2.s390.rpm SHA-256: c1ea54354c914e806f30f40bfec7dab8ef3b1854537c3f5ea727895b805be007
httpd-suexec-2.0.52-38.ent.2.s390.rpm SHA-256: 371b31e8320ed9353221fcea2e76d11f74721c3941dd489d0125532f25d2da50
mod_ssl-2.0.52-38.ent.2.s390.rpm SHA-256: cc4a64eaf7a8c3cabde464bff489340a45ab5ada0f9d223077edf3ac6210ab40

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.6

SRPM
s390
httpd-2.0.52-38.ent.2.s390.rpm SHA-256: ac68a5f83b9e2ba372f6ad32536aa076f5401e67cf85756cead148a7f3f81dca
httpd-devel-2.0.52-38.ent.2.s390.rpm SHA-256: da3554c008a6b85754295a212660098406b193904d55f76ea585a7e57b4eb339
httpd-manual-2.0.52-38.ent.2.s390.rpm SHA-256: c1ea54354c914e806f30f40bfec7dab8ef3b1854537c3f5ea727895b805be007
httpd-suexec-2.0.52-38.ent.2.s390.rpm SHA-256: 371b31e8320ed9353221fcea2e76d11f74721c3941dd489d0125532f25d2da50
mod_ssl-2.0.52-38.ent.2.s390.rpm SHA-256: cc4a64eaf7a8c3cabde464bff489340a45ab5ada0f9d223077edf3ac6210ab40

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.