Skip to navigation

Security Advisory Updated secureweb packages available

Advisory: RHSA-2001:164-10
Type: Security Advisory
Severity: N/A
Issued on: 2001-12-05
Last updated on: 2001-12-07
Affected Products:
CVEs (cve.mitre.org): CVE-2001-0730
CVE-2001-0731

Details

Updated packages are now available for Red Hat Secure Web Server 3.2 (U.S.).
These updates close a potential security hole which would present clients
with a listing of the contents of a directory instead of the contents of an
index file or the proper error message.

The previous revision of this errata advisory included incorrect URLs. This
revision lists the correct location of the updated packages.

By using a carefully constructed HTTP request, a server with
mod_negotiation and either mod_dir or mod_autoindex loaded could be tricked
into displaying a listing of the contents of a directory, despite the
presence of an index file.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2001-0730, and CAN-2001-0731 to these issues.


Solution

The main secureweb package is provided as an rhmask file. In order to
generate the actual secureweb RPM package, you will need the
secureweb-3.2-12 package file from the Secure Web Server CD. Then, using
the rhmask command, generate the secureweb RPM package:

rhmask secureweb-3.2-12.i386.rpm secureweb-3.2.4-1.i386.rpm.rhmask

Before applying this update, make sure you have applied all previously
released errata relevant to your system.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Updated packages


References


Keywords

directory, listing, secureweb


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/