|
|
Family: Red Hat Local Security Checks --> Category: infos
RHSA-2004-342: httpd Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the httpd packages
Detailed Explanation for this Vulnerability Test
Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely
triggerable memory leak are now available.
The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.
A stack buffer overflow was discovered in mod_ssl that could be triggered
if using the FakeBasicAuth option. If mod_ssl was sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow
occured if FakeBasicAuth had been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have had to be signed by
a Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CVE-2004-0488 to this issue.
A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2004-0493 to this issue.
Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.
Solution : http://rhn.redhat.com/errata/RHSA-2004-342.html
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
