Updated secureweb packages available
|Last updated on:||2001-12-07|
Updated packages are now available for Red Hat Secure Web Server 3.2 (U.S.).
These updates close a potential security hole which would present clients
with a listing of the contents of a directory instead of the contents of an
index file or the proper error message.
The previous revision of this errata advisory included incorrect URLs. This
revision lists the correct location of the updated packages.
By using a carefully constructed HTTP request, a server with
mod_negotiation and either mod_dir or mod_autoindex loaded could be tricked
into displaying a listing of the contents of a directory, despite the
presence of an index file.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2001-0730, and CAN-2001-0731 to these issues.
generate the actual secureweb RPM package, you will need the
secureweb-3.2-12 package file from the Secure Web Server CD. Then, using
the rhmask command, generate the secureweb RPM package:
rhmask secureweb-3.2-12.i386.rpm secureweb-3.2.4-1.i386.rpm.rhmask
Before applying this update, make sure you have applied all previously
released errata relevant to your system.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: