apache security update for Stronghold

Updated Apache packages are available which fix a security issue by
preventing control characters from being written to the error log. The
updated packages also include a minor bug fix for mod_proxy.

The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.

The Apache Web server before 1.3.25 does not prevent escape sequences from
being written to the error and access logs. This could allow an attacker
to embed arbitrary escape sequences into the log file. A recent paper by
HD Moore highlighted several issues where common terminal emulator software
(such as xterm) can be remotely abused or exploited by displaying arbitrary
escape sequences.

If Apache is configured to act as a reverse proxy by specifying the backend
server using a numeric IP address, the mod_proxy module will perform a
redundant reverse DNS lookup on the IP address, causing a delay in request
processing.

Users are advised to install these updated packages which contain: a
patched version of Apache which prevents control characters from being
written to log files; and a patched version of mod_proxy which does not
perform reverse DNS lookups unless necessary.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0020
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0083
http://www.digitaldefense.net/labs/papers/Termulation.txt

apache, escape, log, mod_proxy, Stronghold