Updated apache packages available

Updated Apache packages are now available for Red Hat Linux 6.2, 7, 7.1,
and 7.2. These packages upgrade the Apache Web server to version 1.3.22,
which closes a potential security bug which would present clients with a
listing of the contents of a directory instead of the contents of an index
file, or in case of an error, the error message.

By using a carefully constructed HTTP request, a server with
mod_negotiation and either mod_dir or mod_autoindex loaded could be tricked
into displaying a listing of the contents of a directory, despite the
presence of an index file.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2001-0730, and CAN-2001-0731 to these
issues.

Note: The updated apache (and apache-devel) packages for Red Hat Linux 7,
7.1, and 7.2 require installation of mm and expat (as well as mm-devel and
expat-devel for apache-devel). Because mm and expat were not previously
released for Red Hat Linux 7, and mm was not previously released for Red
Hat Linux 7.1, they will need to either be installed simultaneously with or
before the apache packages.

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Users of Red Hat Linux 7 and
7.1 will find that the mod_bandwidth, mod_put, and mod_throttle packages
are now built as separate packages, and that they will need to manually
install these packages as well.

To update all other RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Users of Red Hat Linux 7 will find that these updates enable the suexec
feature by default, which was not the case in previous versions of this
package. Administrators who have configured their servers to run CGI
scripts from user home directories should read the suexec documentation
included in the apache-manual package.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

34772 - Apache 1.3.14 breaks byterange functionality (hinders serving of PDFs)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0731
http://www.apacheweek.com/issues/01-10-05#security
http://httpd.apache.org/dist/httpd/CHANGES_1.3
http://www.securityfocus.com/bid/3009

apache, directory, listing