| Description: | Description:
The remote host is missing an update to Apache
announced via advisory FEDORA-2007-0704.
The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service (CVE-2007-3304). This issue is not exploitable on Fedora if using the default SELinux targeted policy.
A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Fedora the server-status page is not enabled by default and it is best practice to not make this publicly available. (CVE-2006-5752)
A bug was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)
A bug was found in the mod_mem_cache module. On sites where caching is enabled using this module, an information leak could occur which revealed portions of sensitive memory to remote users. (CVE-2007-1862)
ChangeLog:
* Tue Jun 26 2007 Joe Orton 2.2.4-4.1.fc7
- add security fixes for CVE-2007-1863, CVE-2007-3304,
and CVE-2006-5752 (#244665)
- add security fix for CVE-2007-1862 (#242606)
Additional References:
[ 1 ] Bug #242606
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=242606
[ 2 ] Bug #244659
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=244659
Solution: Apply the appropriate updates.
This update can be installed with the 'yum' update program. Use 'yum update
package-name' at the command line. For more information, refer to 'Managing
Software with yum,' available at http://docs.fedoraproject.org/yum/.
https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2007-0704
Risk factor : Medium
CVSS Score:
5.0
|
