Skip to navigation

Security Advisory Moderate: httpd security update

Advisory: RHSA-2008:0006-6
Type: Security Advisory
Severity: Moderate
Issued on: 2008-01-15
Last updated on: 2008-01-15
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.6.z)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.6.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2007-4465
CVE-2007-5000
CVE-2007-6388
CVE-2008-0005

Details

Updated Apache httpd packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the mod_imap module. On sites where mod_imap was
enabled and an imagemap file was publicly available, a cross-site scripting
attack was possible. (CVE-2007-5000)

A flaw was found in the mod_autoindex module. On sites where directory
listings are used, and the "AddDefaultCharset" directive has been removed
from the configuration, a cross-site scripting attack was possible against
Web browsers which do not correctly derive the response character set
following the rules in RFC 2616. (CVE-2007-4465)

A flaw was found in the mod_status module. On sites where mod_status was
enabled and the status pages were publicly available, a cross-site
scripting attack was possible. (CVE-2007-6388)

A flaw was found in the mod_proxy_ftp module. On sites where mod_proxy_ftp
was enabled and a forward proxy was configured, a cross-site scripting
attack was possible against Web browsers which do not correctly derive the
response character set following the rules in RFC 2616. (CVE-2008-0005)

Users of Apache httpd should upgrade to these updated packages, which
contain backported patches to resolve these issues. Users should restart
httpd after installing this update.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Desktop (v. 4)

SRPMS:
httpd-2.0.52-38.ent.2.src.rpm
File outdated by:  RHSA-2011:1392
    MD5: 691bc43d6ec19f9da8915cf4d43ffe69
 
IA-32:
httpd-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 792fc8f8dd57638e42ed0fcef5a41804
httpd-devel-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 57603e243486d7079acf23868951713a
httpd-manual-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: ca1a56b87cc28a3daf4f65260b4328fe
httpd-suexec-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: b514d321e4d1da024efcf5732dafc717
mod_ssl-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 828138bf7bbd6fcf900d66bfd529a0c5
 
x86_64:
httpd-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 58129d7f31b0f44bea5018a02a8fe1e2
httpd-devel-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: b1d41e5cdd3a5975c3c5ab6bcb3d3188
httpd-manual-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: cf67a0b896a353eb761fabff99408449
httpd-suexec-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 8127b6abf04eb0e22d8527616e5ecdca
mod_ssl-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: f400e221e922ead0b18f940f5b554b87
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
httpd-2.0.52-38.ent.2.src.rpm
File outdated by:  RHSA-2011:1392
    MD5: 691bc43d6ec19f9da8915cf4d43ffe69
 
IA-32:
httpd-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 792fc8f8dd57638e42ed0fcef5a41804
httpd-devel-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 57603e243486d7079acf23868951713a
httpd-manual-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: ca1a56b87cc28a3daf4f65260b4328fe
httpd-suexec-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: b514d321e4d1da024efcf5732dafc717
mod_ssl-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 828138bf7bbd6fcf900d66bfd529a0c5
 
IA-64:
httpd-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: ccbfccb2a31823b47445059db01302dc
httpd-devel-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 9761af1eeec91ed4ebf73a1e32881610
httpd-manual-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 549467b8489bb9ff0b28e80294c1dae4
httpd-suexec-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 3e59ee51689fef0aa27a30fd3f668b98
mod_ssl-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: d96be72514a56dc3672394b5f07a7534
 
PPC:
httpd-2.0.52-38.ent.2.ppc.rpm
File outdated by:  RHSA-2011:1392
    MD5: 8895130023a32a74f5bd97c04e57e27f
httpd-devel-2.0.52-38.ent.2.ppc.rpm
File outdated by:  RHSA-2011:1392
    MD5: e9b88f832008e692c0a6e051a45cd30d
httpd-manual-2.0.52-38.ent.2.ppc.rpm
File outdated by:  RHSA-2011:1392
    MD5: cfda3ec514240899e8bb10178a51c5f7
httpd-suexec-2.0.52-38.ent.2.ppc.rpm
File outdated by:  RHSA-2011:1392
    MD5: d07ce658b49af47b18b2882baa59bbaa
mod_ssl-2.0.52-38.ent.2.ppc.rpm
File outdated by:  RHSA-2011:1392
    MD5: 03455e48deeae6aa550c594582597789
 
s390:
httpd-2.0.52-38.ent.2.s390.rpm
File outdated by:  RHSA-2011:1392
    MD5: 893508dc9d10551e403bcaf904a9b4a9
httpd-devel-2.0.52-38.ent.2.s390.rpm
File outdated by:  RHSA-2011:1392
    MD5: 1ebc0562540c7f007d09174231a35b74
httpd-manual-2.0.52-38.ent.2.s390.rpm
File outdated by:  RHSA-2011:1392
    MD5: 8c5e6fe4797de33b2a8fbb7203432a2a
httpd-suexec-2.0.52-38.ent.2.s390.rpm
File outdated by:  RHSA-2011:1392
    MD5: c28f2dac3ce7681317423398e7d5bc8b
mod_ssl-2.0.52-38.ent.2.s390.rpm
File outdated by:  RHSA-2011:1392
    MD5: a73f7494af9053b7ed6532a3bad934f9
 
s390x:
httpd-2.0.52-38.ent.2.s390x.rpm
File outdated by:  RHSA-2011:1392
    MD5: 0e656c39c7bb6d602fa296de6582b345
httpd-devel-2.0.52-38.ent.2.s390x.rpm
File outdated by:  RHSA-2011:1392
    MD5: c8927565a9fd44ca14e7515830a6a657
httpd-manual-2.0.52-38.ent.2.s390x.rpm
File outdated by:  RHSA-2011:1392
    MD5: 4038aefaca6696c6aa280a132778d433
httpd-suexec-2.0.52-38.ent.2.s390x.rpm
File outdated by:  RHSA-2011:1392
    MD5: b26795f4695c17216aad21c1c806f7cf
mod_ssl-2.0.52-38.ent.2.s390x.rpm
File outdated by:  RHSA-2011:1392
    MD5: c172400379ae45dc79ecf11b3c48d852
 
x86_64:
httpd-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 58129d7f31b0f44bea5018a02a8fe1e2
httpd-devel-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: b1d41e5cdd3a5975c3c5ab6bcb3d3188
httpd-manual-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: cf67a0b896a353eb761fabff99408449
httpd-suexec-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 8127b6abf04eb0e22d8527616e5ecdca
mod_ssl-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: f400e221e922ead0b18f940f5b554b87
 
Red Hat Enterprise Linux AS (v. 4.6.z)

SRPMS:
httpd-2.0.52-38.ent.2.src.rpm
File outdated by:  RHSA-2011:1392
    MD5: 691bc43d6ec19f9da8915cf4d43ffe69
 
IA-32:
httpd-2.0.52-38.ent.2.i386.rpm     MD5: 792fc8f8dd57638e42ed0fcef5a41804
httpd-devel-2.0.52-38.ent.2.i386.rpm     MD5: 57603e243486d7079acf23868951713a
httpd-manual-2.0.52-38.ent.2.i386.rpm     MD5: ca1a56b87cc28a3daf4f65260b4328fe
httpd-suexec-2.0.52-38.ent.2.i386.rpm     MD5: b514d321e4d1da024efcf5732dafc717
mod_ssl-2.0.52-38.ent.2.i386.rpm     MD5: 828138bf7bbd6fcf900d66bfd529a0c5
 
IA-64:
httpd-2.0.52-38.ent.2.ia64.rpm     MD5: ccbfccb2a31823b47445059db01302dc
httpd-devel-2.0.52-38.ent.2.ia64.rpm     MD5: 9761af1eeec91ed4ebf73a1e32881610
httpd-manual-2.0.52-38.ent.2.ia64.rpm     MD5: 549467b8489bb9ff0b28e80294c1dae4
httpd-suexec-2.0.52-38.ent.2.ia64.rpm     MD5: 3e59ee51689fef0aa27a30fd3f668b98
mod_ssl-2.0.52-38.ent.2.ia64.rpm     MD5: d96be72514a56dc3672394b5f07a7534
 
PPC:
httpd-2.0.52-38.ent.2.ppc.rpm     MD5: 8895130023a32a74f5bd97c04e57e27f
httpd-devel-2.0.52-38.ent.2.ppc.rpm     MD5: e9b88f832008e692c0a6e051a45cd30d
httpd-manual-2.0.52-38.ent.2.ppc.rpm     MD5: cfda3ec514240899e8bb10178a51c5f7
httpd-suexec-2.0.52-38.ent.2.ppc.rpm     MD5: d07ce658b49af47b18b2882baa59bbaa
mod_ssl-2.0.52-38.ent.2.ppc.rpm     MD5: 03455e48deeae6aa550c594582597789
 
s390:
httpd-2.0.52-38.ent.2.s390.rpm     MD5: 893508dc9d10551e403bcaf904a9b4a9
httpd-devel-2.0.52-38.ent.2.s390.rpm     MD5: 1ebc0562540c7f007d09174231a35b74
httpd-manual-2.0.52-38.ent.2.s390.rpm     MD5: 8c5e6fe4797de33b2a8fbb7203432a2a
httpd-suexec-2.0.52-38.ent.2.s390.rpm     MD5: c28f2dac3ce7681317423398e7d5bc8b
mod_ssl-2.0.52-38.ent.2.s390.rpm     MD5: a73f7494af9053b7ed6532a3bad934f9
 
s390x:
httpd-2.0.52-38.ent.2.s390x.rpm     MD5: 0e656c39c7bb6d602fa296de6582b345
httpd-devel-2.0.52-38.ent.2.s390x.rpm     MD5: c8927565a9fd44ca14e7515830a6a657
httpd-manual-2.0.52-38.ent.2.s390x.rpm     MD5: 4038aefaca6696c6aa280a132778d433
httpd-suexec-2.0.52-38.ent.2.s390x.rpm     MD5: b26795f4695c17216aad21c1c806f7cf
mod_ssl-2.0.52-38.ent.2.s390x.rpm     MD5: c172400379ae45dc79ecf11b3c48d852
 
x86_64:
httpd-2.0.52-38.ent.2.x86_64.rpm     MD5: 58129d7f31b0f44bea5018a02a8fe1e2
httpd-devel-2.0.52-38.ent.2.x86_64.rpm     MD5: b1d41e5cdd3a5975c3c5ab6bcb3d3188
httpd-manual-2.0.52-38.ent.2.x86_64.rpm     MD5: cf67a0b896a353eb761fabff99408449
httpd-suexec-2.0.52-38.ent.2.x86_64.rpm     MD5: 8127b6abf04eb0e22d8527616e5ecdca
mod_ssl-2.0.52-38.ent.2.x86_64.rpm     MD5: f400e221e922ead0b18f940f5b554b87
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
httpd-2.0.52-38.ent.2.src.rpm
File outdated by:  RHSA-2011:1392
    MD5: 691bc43d6ec19f9da8915cf4d43ffe69
 
IA-32:
httpd-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 792fc8f8dd57638e42ed0fcef5a41804
httpd-devel-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 57603e243486d7079acf23868951713a
httpd-manual-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: ca1a56b87cc28a3daf4f65260b4328fe
httpd-suexec-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: b514d321e4d1da024efcf5732dafc717
mod_ssl-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 828138bf7bbd6fcf900d66bfd529a0c5
 
IA-64:
httpd-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: ccbfccb2a31823b47445059db01302dc
httpd-devel-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 9761af1eeec91ed4ebf73a1e32881610
httpd-manual-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 549467b8489bb9ff0b28e80294c1dae4
httpd-suexec-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 3e59ee51689fef0aa27a30fd3f668b98
mod_ssl-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: d96be72514a56dc3672394b5f07a7534
 
x86_64:
httpd-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 58129d7f31b0f44bea5018a02a8fe1e2
httpd-devel-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: b1d41e5cdd3a5975c3c5ab6bcb3d3188
httpd-manual-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: cf67a0b896a353eb761fabff99408449
httpd-suexec-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 8127b6abf04eb0e22d8527616e5ecdca
mod_ssl-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: f400e221e922ead0b18f940f5b554b87
 
Red Hat Enterprise Linux ES (v. 4.6.z)

SRPMS:
httpd-2.0.52-38.ent.2.src.rpm
File outdated by:  RHSA-2011:1392
    MD5: 691bc43d6ec19f9da8915cf4d43ffe69
 
IA-32:
httpd-2.0.52-38.ent.2.i386.rpm     MD5: 792fc8f8dd57638e42ed0fcef5a41804
httpd-devel-2.0.52-38.ent.2.i386.rpm     MD5: 57603e243486d7079acf23868951713a
httpd-manual-2.0.52-38.ent.2.i386.rpm     MD5: ca1a56b87cc28a3daf4f65260b4328fe
httpd-suexec-2.0.52-38.ent.2.i386.rpm     MD5: b514d321e4d1da024efcf5732dafc717
mod_ssl-2.0.52-38.ent.2.i386.rpm     MD5: 828138bf7bbd6fcf900d66bfd529a0c5
 
IA-64:
httpd-2.0.52-38.ent.2.ia64.rpm     MD5: ccbfccb2a31823b47445059db01302dc
httpd-devel-2.0.52-38.ent.2.ia64.rpm     MD5: 9761af1eeec91ed4ebf73a1e32881610
httpd-manual-2.0.52-38.ent.2.ia64.rpm     MD5: 549467b8489bb9ff0b28e80294c1dae4
httpd-suexec-2.0.52-38.ent.2.ia64.rpm     MD5: 3e59ee51689fef0aa27a30fd3f668b98
mod_ssl-2.0.52-38.ent.2.ia64.rpm     MD5: d96be72514a56dc3672394b5f07a7534
 
x86_64:
httpd-2.0.52-38.ent.2.x86_64.rpm     MD5: 58129d7f31b0f44bea5018a02a8fe1e2
httpd-devel-2.0.52-38.ent.2.x86_64.rpm     MD5: b1d41e5cdd3a5975c3c5ab6bcb3d3188
httpd-manual-2.0.52-38.ent.2.x86_64.rpm     MD5: cf67a0b896a353eb761fabff99408449
httpd-suexec-2.0.52-38.ent.2.x86_64.rpm     MD5: 8127b6abf04eb0e22d8527616e5ecdca
mod_ssl-2.0.52-38.ent.2.x86_64.rpm     MD5: f400e221e922ead0b18f940f5b554b87
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
httpd-2.0.52-38.ent.2.src.rpm
File outdated by:  RHSA-2011:1392
    MD5: 691bc43d6ec19f9da8915cf4d43ffe69
 
IA-32:
httpd-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 792fc8f8dd57638e42ed0fcef5a41804
httpd-devel-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 57603e243486d7079acf23868951713a
httpd-manual-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: ca1a56b87cc28a3daf4f65260b4328fe
httpd-suexec-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: b514d321e4d1da024efcf5732dafc717
mod_ssl-2.0.52-38.ent.2.i386.rpm
File outdated by:  RHSA-2011:1392
    MD5: 828138bf7bbd6fcf900d66bfd529a0c5
 
IA-64:
httpd-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: ccbfccb2a31823b47445059db01302dc
httpd-devel-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 9761af1eeec91ed4ebf73a1e32881610
httpd-manual-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 549467b8489bb9ff0b28e80294c1dae4
httpd-suexec-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 3e59ee51689fef0aa27a30fd3f668b98
mod_ssl-2.0.52-38.ent.2.ia64.rpm
File outdated by:  RHSA-2011:1392
    MD5: d96be72514a56dc3672394b5f07a7534
 
x86_64:
httpd-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 58129d7f31b0f44bea5018a02a8fe1e2
httpd-devel-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: b1d41e5cdd3a5975c3c5ab6bcb3d3188
httpd-manual-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: cf67a0b896a353eb761fabff99408449
httpd-suexec-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: 8127b6abf04eb0e22d8527616e5ecdca
mod_ssl-2.0.52-38.ent.2.x86_64.rpm
File outdated by:  RHSA-2011:1392
    MD5: f400e221e922ead0b18f940f5b554b87
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

289511 - CVE-2007-4465 mod_autoindex XSS
419931 - CVE-2007-5000 mod_imagemap XSS
427228 - CVE-2007-6388 apache mod_status cross-site scripting
427739 - CVE-2008-0005 mod_proxy_ftp XSS


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/