Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold
Updated versions of the Apache HTTP server, PHP, and mod_ssl are now available which close possible buffer overflows in the Apache HTTP server benchmarking tool, fixes two cross-site scripting vulnerabilities in the error pages, and fix possible local privilege escalation. These updates also fix vulnerabilities in the PHP mail() function that allows script authors to bypass safe mode restrictions, and possibly allow remote attackers to insert arbitrary mail headers and content into messages.
beschreibt (6)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2002-1157US | high7.5 | — | ||
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute scri… | ||||
| CVE-2002-0839US | high7.2 | — | ||
The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting… | ||||
| CVE-2002-0840US | medium6.8 | Exploit | ||
Cross-site scripting (XSS) vulnerability in the default error page of Apache 2.0 before 2.0.43, and 1.3.x up to 1.3.26, when UseCanonicalName is "Off" and support for wildcard DNS… | ||||
| CVE-2002-0843US | high7.5 | — | ||
Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of servic… | ||||
| CVE-2002-0985US | high7.5 | — | ||
Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. s… | ||||
| CVE-2002-0986US | medium5.0 | — | ||
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (6)
- BehobenRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - BehobenRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - BehobenRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - BehobenRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - BehobenRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243 - BehobenRed Hat Stronghold 3
Backported fixes are available for the versions of Apache, mod_ssl, and PHP included in Stronghold 3. Stronghold 3 build code 3020 is now available which includes this fix, and can be downloaded from the following URL: http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3, refer to the following URL: http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:243
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan