CVE-2008-2939
The MITRE CVE dictionary describes this issue as:
Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
Find out more about CVE-2008-2939 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
These issue was addressed in all affected httpd versions as shipped in Red Hat Enterprise Linux 3, 4, and 5 were fixed via: https://rhn.redhat.com/errata/RHSA-2008-0967.html
This issue is tracked via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-2939
The Red Hat Security Response Team has rated this issue as having low security impact, future updates may address this flaw in other affected products (such as Red Hat Application Stack).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Application Stack v2 for Enterprise Linux (v.5) (httpd) | RHSA-2008:0966 | 2008-12-04 |
| Red Hat Enterprise Linux 3 (httpd) | RHSA-2008:0967 | 2008-11-11 |
| Red Hat Certificate System 7.3 for 4AS | RHSA-2010:0602 | 2010-08-04 |
| Red Hat Enterprise Linux 5 (httpd) | RHSA-2008:0967 | 2008-11-11 |
| Red Hat Enterprise Linux 4 (httpd) | RHSA-2008:0967 | 2008-11-11 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Directory Server 8 | httpd | Will not fix |
CVE description copyright © 2017, The MITRE Corporation