exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2008-014

Mandriva Linux Security Advisory 2008-014
Posted Jan 17, 2008
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory - A flaw found in the mod_autoindex module could lead to a cross-site scripting attack on sites where mod_autoindex was enabled and the AddDefaultCharset directive was removed from the configuration, against web browsers that did not correctly derive the response character set following the rules in RFC 2616. A flaw found in the mod_imagemap module could lead to a cross-site scripting attack on sites where mod_imagemap was enabled and an imagemap file was publicly available. A flaw found in the mod_status module could lead to a cross-site scripting attack on sites where mod_status was enabled and the status pages were publicly available. A flaw found in the mod_proxy_ftp module could lead to a cross-site scripting attack against web browsers which do not correctly derive the response character set following the rules in RFC 2616, on sites where the mod_proxy_ftp module was enabled.

tags | advisory, web, xss
systems | linux, mandriva
advisories | CVE-2007-4465, CVE-2007-5000, CVE-2007-6388, CVE-2008-0005
SHA-256 | 99928353f403d25058b0be4b7ae1cc98fadff2fc75cd15dec8eded067ebadb82

Mandriva Linux Security Advisory 2008-014

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:014
http://www.mandriva.com/security/
_______________________________________________________________________

Package : apache
Date : January 16, 2008
Affected: Corporate 3.0
_______________________________________________________________________

Problem Description:

A number of vulnerabilities were found and fixed in the Apache 1.3.x
packages:

A flaw found in the mod_autoindex module could lead to a cross-site
scripting attack on sites where mod_autoindex was enabled and the
AddDefaultCharset directive was removed from the configuration,
against web browsers that did not correctly derive the response
character set following the rules in RFC 2616 (CVE-2007-4465).

A flaw found in the mod_imagemap module could lead to a cross-site
scripting attack on sites where mod_imagemap was enabled and an
imagemap file was publically available (CVE-2007-5000).

A flaw found in the mod_status module could lead to a cross-site
scripting attack on sites where mod_status was enabled and the status
pages were publically available (CVE-2007-6388).

A flaw found in the mod_proxy_ftp module could lead to a cross-site
scripting attack against web browsers which do not correctly derive
the response character set following the rules in RFC 2616, on sites
where the mod_proxy_ftp module was enabled (CVE-2008-0005).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005
_______________________________________________________________________

Updated Packages:

Corporate 3.0:
c9c5c7f93bb0fa94835c5594bf210549 corporate/3.0/i586/apache-1.3.29-1.7.C30mdk.i586.rpm
bddc9c4aad23e8601d8a836e92e8808a corporate/3.0/i586/apache-devel-1.3.29-1.7.C30mdk.i586.rpm
cc176ace02cacae3749540e61e495234 corporate/3.0/i586/apache-modules-1.3.29-1.7.C30mdk.i586.rpm
9289b7b9e19b966f15eea0fe8e183d3e corporate/3.0/i586/apache-source-1.3.29-1.7.C30mdk.i586.rpm
8efcd88ed1620fc9dd2f708af8f44a07 corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm

Corporate 3.0/X86_64:
59ca425ea89cfb2d67cccec0da61aa50 corporate/3.0/x86_64/apache-1.3.29-1.7.C30mdk.x86_64.rpm
a8ff18539221b129855cf9255fe6a68c corporate/3.0/x86_64/apache-devel-1.3.29-1.7.C30mdk.x86_64.rpm
4c65bba7f8538b1d50eab4fdfc161fb4 corporate/3.0/x86_64/apache-modules-1.3.29-1.7.C30mdk.x86_64.rpm
28bb131ffe555d1e945c824a109f1724 corporate/3.0/x86_64/apache-source-1.3.29-1.7.C30mdk.x86_64.rpm
8efcd88ed1620fc9dd2f708af8f44a07 corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHjleYmqjQ0CJFipgRAmsPAKCl2buf2vYqjKIRwmNJBE9Uw2xPdACg0m4J
rg2ebG2n+L9LsBYZApkisVE=
=DgHQ
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close