Sårbarhed Detalje Syn
Legend :
critical
high
medium
low
other
| id | 43090 |
|---|
| Risiko | other |
|---|
| Familie | Fedora Local Security Checks |
|---|
| Kategori | infos |
|---|
| Navn | Fedora 10 2009-12604: httpd |
|---|
| Sammenfatning | Check for the version of the httpd package |
|---|
| Beskrivelse | Synopsis :
The remote host is missing the patch for the advisory FEDORA-2009-12604 (httpd)
Description :
The Apache HTTP Server is a powerful, efficient, and extensible
web server.
-
Update Information:
This update contains the latest stable release of Apache httpd. Three security
fixes are included, along with several minor bug fixes. A flaw was found in
the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols
handle session renegotiation. A man-in-the-middle attacker could use this flaw
to prefix arbitrary plain text to a client's session (for example, an HTTPS
connection to a website). This could force the server to process an attacker's
request as if authenticated using the victim's credentials. This update
partially mitigates this flaw for SSL sessions to HTTP servers using mod_ssl by
rejecting client-requested renegotiation. (CVE-2009-3555) Note: This update
does not fully resolve the issue for HTTPS servers. An attack is still possible
in configurations that require a server-initiated renegotiation A NULL
pointer dereference flaw was found in the Apache mod_proxy_ftp module. A
malicious FTP server to which requests are being proxied could use this flaw to
crash an httpd child process via a malformed reply to the EPSV or PASV commands
,
resulting in a limited denial of service. (CVE-2009-3094) A second flaw was
found in the Apache mod_proxy_ftp module. In a reverse proxy configuration, a
remote attacker could use this flaw to bypass intended access restrictions by
creating a carefully-crafted HTTP Authorization header, allowing the attacker t
o
send arbitrary commands to the FTP server. (CVE-2009-3095) See the upstream
changes file for further information:
[9]http://www.apache.org/dist/httpd/CHANGES_2.2.14
Solution :
Get the newest Fedora Updates
Risk factor :
High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
|---|
| CVE |
CVE-2009-3094,CVE-2009-3095,CVE-2009-3555 |
| Bugtraq |
NOBID |
| Copyright |
(C) 2009 Tenable Network Security, Inc. |
|
|