full-disclosure - [ MDVSA-2008:014 ] - Updated apache 1.3.x packages fix multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <E1JFGZ0-0004BZ-8e@artemis.annvix.ca>
Date: Wed, 16 Jan 2008 15:16:50 -0700
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2008:014 ] - Updated apache 1.3.x
 packages fix multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2008:014
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : apache
 Date    : January 16, 2008
 Affected: Corporate 3.0
 _______________________________________________________________________

 Problem Description:

 A number of vulnerabilities were found and fixed in the Apache 1.3.x
 packages:

 A flaw found in the mod_autoindex module could lead to a cross-site
 scripting attack on sites where mod_autoindex was enabled and the
 AddDefaultCharset directive was removed from the configuration,
 against web browsers that did not correctly derive the response
 character set following the rules in RFC 2616 (CVE-2007-4465).

 A flaw found in the mod_imagemap module could lead to a cross-site
 scripting attack on sites where mod_imagemap was enabled and an
 imagemap file was publically available (CVE-2007-5000).

 A flaw found in the mod_status module could lead to a cross-site
 scripting attack on sites where mod_status was enabled and the status
 pages were publically available (CVE-2007-6388).

 A flaw found in the mod_proxy_ftp module could lead to a cross-site
 scripting attack against web browsers which do not correctly derive
 the response character set following the rules in RFC 2616, on sites
 where the mod_proxy_ftp module was enabled (CVE-2008-0005).

 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005
 _______________________________________________________________________

 Updated Packages:

 Corporate 3.0:
 c9c5c7f93bb0fa94835c5594bf210549  corporate/3.0/i586/apache-1.3.29-1.7.C30mdk.i586.rpm
 bddc9c4aad23e8601d8a836e92e8808a  corporate/3.0/i586/apache-devel-1.3.29-1.7.C30mdk.i586.rpm
 cc176ace02cacae3749540e61e495234  corporate/3.0/i586/apache-modules-1.3.29-1.7.C30mdk.i586.rpm
 9289b7b9e19b966f15eea0fe8e183d3e  corporate/3.0/i586/apache-source-1.3.29-1.7.C30mdk.i586.rpm 
 8efcd88ed1620fc9dd2f708af8f44a07  corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 59ca425ea89cfb2d67cccec0da61aa50  corporate/3.0/x86_64/apache-1.3.29-1.7.C30mdk.x86_64.rpm
 a8ff18539221b129855cf9255fe6a68c  corporate/3.0/x86_64/apache-devel-1.3.29-1.7.C30mdk.x86_64.rpm
 4c65bba7f8538b1d50eab4fdfc161fb4  corporate/3.0/x86_64/apache-modules-1.3.29-1.7.C30mdk.x86_64.rpm
 28bb131ffe555d1e945c824a109f1724  corporate/3.0/x86_64/apache-source-1.3.29-1.7.C30mdk.x86_64.rpm 
 8efcd88ed1620fc9dd2f708af8f44a07  corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHjleYmqjQ0CJFipgRAmsPAKCl2buf2vYqjKIRwmNJBE9Uw2xPdACg0m4J
rg2ebG2n+L9LsBYZApkisVE=
=DgHQ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/