Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold
Updated versions of the Apache HTTP server, PHP, and mod_ssl are now available which close possible buffer overflows in the Apache HTTP server benchmarking tool, fix two cross-site scripting vulnerabilities in the error pages, and fix possible local privilege escalation. These updates also fix vulnerabilities in the PHP mail() function that allows script authors to bypass safe mode restrictions, and possibly allow remote attackers to insert arbitrary mail headers and content into messages.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2002-1157US | high7.5 | — | ||
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute scri… | ||||
| CVE-2002-0839US | high7.2 | — | ||
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting… | ||||
| CVE-2002-0840US | medium6.8 | Exploit | ||
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS… | ||||
| CVE-2002-0843US | high7.5 | — | ||
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of servic… | ||||
| CVE-2002-0985US | high7.5 | — | ||
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. s… | ||||
| CVE-2002-0986US | medium5.0 | — | ||
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail… | ||||
references
External citations — patches, advisories, analysis.
remediations (6)
- FixedRed Hat Stronghold 4
We have backported the security fixes for the versions of OpenSSL and mm included in Stronghold 4. The fixed packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2002:244 - FixedRed Hat Stronghold 4
We have backported the security fixes for the versions of OpenSSL and mm included in Stronghold 4. The fixed packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2002:244 - FixedRed Hat Stronghold 4
We have backported the security fixes for the versions of OpenSSL and mm included in Stronghold 4. The fixed packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2002:244 - FixedRed Hat Stronghold 4
We have backported the security fixes for the versions of OpenSSL and mm included in Stronghold 4. The fixed packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2002:244 - FixedRed Hat Stronghold 4
We have backported the security fixes for the versions of OpenSSL and mm included in Stronghold 4. The fixed packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2002:244 - FixedRed Hat Stronghold 4
We have backported the security fixes for the versions of OpenSSL and mm included in Stronghold 4. The fixed packages are now available via the update agent service; run $ bin/agent from the Stronghold 4 install root to upgrade an existing Stronghold 4 installation to the new package versions. After upgrading Stronghold, the server must be completely restarted by running the following commands from the install root: $ bin/stop-server $ bin/start-server For more information on how to upgrade between releases of Stronghold 4, see http://stronghold.redhat.com/support/upgrade-sh4
https://access.redhat.com/errata/RHSA-2002:244
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan