TITLE:
Sun Solaris Multiple Apache Vulnerabilities

SECUNIA ADVISORY ID:
SA19073

VERIFY ADVISORY:
http://secunia.com/advisories/19073/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data,
Privilege escalation

WHERE:
>From remote

OPERATING SYSTEM:
Sun Solaris 9
http://secunia.com/product/95/
Sun Solaris 8
http://secunia.com/product/94/
Sun Solaris 10
http://secunia.com/product/4813/

DESCRIPTION:
Sun has acknowledged some vulnerabilities in Apache for Solaris,
which can be exploited by malicious, local users to gain escalated
privileges, and by malicious people to conduct HTTP request smuggling
attacks and potentially bypass certain security restrictions.

For more information:
SA12898
SA14530
SA16700

The following versions are affected by one or more of the
vulnerabilities on both the SPARC and x86 platforms:
* Solaris 8
* Solaris 9
* Solaris 10

SOLUTION:
The vendor recommends installing Apache 1.3.34 or later from the
Apache site and mod_ssl 2.8.24 or later from the modssl site, until
patches are available.

ORIGINAL ADVISORY:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1

OTHER REFERENCES:
SA12898:
http://secunia.com/advisories/12898/

SA14530:
http://secunia.com/advisories/14530/

SA16700:
http://secunia.com/advisories/16700/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------