RHEL 2.1 : apache (RHSA-2006:0158)

This script is Copyright (C) 2006-2014 Tenable Network Security, Inc.


Synopsis :

The remote Red Hat host is missing one or more security updates.

Description :

Updated Apache httpd packages that correct a security issue are now
available for Red Hat Enterprise Linux 2.1.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

The Apache HTTP Server is a popular and freely-available Web server.

A flaw in mod_imap when using the Referer directive with image maps
was discovered. With certain site configurations, a remote attacker
could perform a cross-site scripting attack if a victim can be forced
to visit a malicious URL using certain web browsers. The Common
Vulnerabilities and Exposures project assigned the name CVE-2005-3352
to this issue.

Users of apache should upgrade to these updated packages, which
contain a backported patch to correct this issue.

See also :

https://www.redhat.com/security/data/cve/CVE-2005-3352.html
http://rhn.redhat.com/errata/RHSA-2006-0158.html

Solution :

Update the affected apache, apache-devel and / or apache-manual
packages.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.7
(CVSS2#E:H/RL:OF/RC:C)
Public Exploit Available : true

Family: Red Hat Local Security Checks

Nessus Plugin ID: 20733 ()

Bugtraq ID: 15834

CVE ID: CVE-2005-3352