Anfälligkeitssuche        Suche in 172616 CVE Beschreibungen
und 81291 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.67082
Kategorie:Red Hat Local Security Checks
Titel:RedHat Security Advisory RHSA-2010:0175
Zusammenfassung:NOSUMMARY
Beschreibung:Description:
The remote host is missing updates announced in
advisory RHSA-2010:0175.

The Apache HTTP Server is a popular web server.

A use-after-free flaw was discovered in the way the Apache HTTP Server
handled request headers in subrequests. In configurations where subrequests
are used, a multithreaded MPM (Multi-Processing Module) could possibly leak
information from other requests in request replies. (CVE-2010-0434)

This update also fixes the following bug:

* a bug was found in the mod_dav module. If a PUT request for an existing
file failed, that file would be unexpectedly deleted and a Could not get
next bucket brigade error logged. With this update, failed PUT requests no
longer cause mod_dav to delete files, which resolves this issue.
(BZ#572932)

As well, this update adds the following enhancement:

* with the updated openssl packages from RHSA-2010:0163 installed, mod_ssl
will refuse to renegotiate a TLS/SSL connection with an unpatched client
that does not support RFC 5746. This update adds the
SSLInsecureRenegotiation configuration directive. If this directive is
enabled, mod_ssl will renegotiate insecurely with unpatched clients.
(BZ#575805)

Refer to the following Red Hat Knowledgebase article for more details about
the changed mod_ssl behavior: http://kbase.redhat.com/faq/docs/DOC-20491

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues and add this enhancement. After
installing the updated packages, the httpd daemon must be restarted for the
update to take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2010-0175.html
http://www.redhat.com/security/updates/classification/#low
http://kbase.redhat.com/faq/docs/DOC-20491

Risk factor : Medium

CVSS Score:
4.3

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2010-0434
AIX APAR: PM08939
http://www-01.ibm.com/support/docview.wss?uid=swg1PM08939
AIX APAR: PM12247
http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247
AIX APAR: PM15829
http://www-01.ibm.com/support/docview.wss?uid=swg1PM15829
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
BugTraq ID: 38494
http://www.securityfocus.com/bid/38494
Debian Security Information: DSA-2035 (Google Search)
http://www.debian.org/security/2010/dsa-2035
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html
HPdes Security Advisory: HPSBUX02531
http://marc.info/?l=bugtraq&m=127557640302499&w=2
HPdes Security Advisory: SSRT100108
https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
http://lists.vmware.com/pipermail/security-announce/2010/000105.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10358
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8695
http://www.redhat.com/support/errata/RHSA-2010-0168.html
http://www.redhat.com/support/errata/RHSA-2010-0175.html
http://secunia.com/advisories/39100
http://secunia.com/advisories/39115
http://secunia.com/advisories/39501
http://secunia.com/advisories/39628
http://secunia.com/advisories/39632
http://secunia.com/advisories/39656
http://secunia.com/advisories/40096
SuSE Security Announcement: SUSE-SR:2010:010 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
http://www.vupen.com/english/advisories/2010/0911
http://www.vupen.com/english/advisories/2010/0994
http://www.vupen.com/english/advisories/2010/1001
http://www.vupen.com/english/advisories/2010/1057
http://www.vupen.com/english/advisories/2010/1411
XForce ISS Database: apache-http-rh-info-disclosure(56625)
https://exchange.xforce.ibmcloud.com/vulnerabilities/56625
CopyrightCopyright (c) 2010 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 81291 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2020 E-Soft Inc. Alle Rechte vorbehalten.