Updated secureweb packages available

Updated packages are now available for Red Hat Secure Web Server 3.2 (U.S.).
These updates close a potential security hole which would present clients
with a listing of the contents of a directory instead of the contents of an
index file or the proper error message.

The previous revision of this errata advisory included incorrect URLs. This
revision lists the correct location of the updated packages.

By using a carefully constructed HTTP request, a server with
mod_negotiation and either mod_dir or mod_autoindex loaded could be tricked
into displaying a listing of the contents of a directory, despite the
presence of an index file.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2001-0730, and CAN-2001-0731 to these issues.

The main secureweb package is provided as an rhmask file. In order to
generate the actual secureweb RPM package, you will need the
secureweb-3.2-12 package file from the Secure Web Server CD. Then, using
the rhmask command, generate the secureweb RPM package:

rhmask secureweb-3.2-12.i386.rpm secureweb-3.2.4-1.i386.rpm.rhmask

Before applying this update, make sure you have applied all previously
released errata relevant to your system.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0731
http://www.apacheweek.com/issues/01-10-05#security
http://httpd.apache.org/dist/httpd/CHANGES_1.3
http://www.securityfocus.com/bid/3009

directory, listing, secureweb