Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold
Updated versions of the Apache HTTP server, PHP, and mod_ssl are now available which close possible buffer overflows in the Apache HTTP server benchmarking tool, fixes two cross-site scripting vulnerabilities in the error pages, and fix possible local privilege escalation. These updates also fix vulnerabilities in the PHP mail() function that allows script authors to bypass safe mode restrictions, and possibly allow remote attackers to insert arbitrary mail headers and content into messages.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2002-1157US | high7.5 | — | ||
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute scri… | ||||
| CVE-2002-0839US | high7.2 | — | ||
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting… | ||||
| CVE-2002-0840US | medium6.8 | Exploit | ||
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS… | ||||
| CVE-2002-0843US | high7.5 | — | ||
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of servic… | ||||
| CVE-2002-0985US | high7.5 | — | ||
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. s… | ||||
| CVE-2002-0986US | medium5.0 | — | ||
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- FixedRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - FixedRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - FixedRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - FixedRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - FixedRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - FixedRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan