Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2002:072: mod_ssl Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the mod_ssl package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2002:072 (mod_ssl).
A cross-site scripting vulnerability was discovered in mod_ssl by Joe Orton.
This only affects servers using a combination of wildcard DNS and
'UseCanonicalName off' (which is not the default in Mandrake Linux). With this
setting turned off, Apache will attempt to use the hostname:port that the client
supplies, which is where the problem comes into play. With this setting turned
on (the default), Apache constructs a self-referencing URL and will use
ServerName and Port to form the canonical name.
It is recommended that all users upgrade, regardless of the setting of the
'UseCanonicalName' configuration option.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2002:072
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.