Scientific Linux Security Update : httpd on SL5.x i386/x86_64

This script is Copyright (C) 2012 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

A flaw was found in the handling of compression structures between
mod_ssl and OpenSSL. If too many connections were opened in a short
period of time, all system memory and swap space would be consumed by
httpd, negatively impacting other processes, or causing a system
crash. (CVE-2008-1678)

A flaw was found in the handling of the 'Options' and 'AllowOverride'
directives. In configurations using the 'AllowOverride' directive with
certain 'Options=' arguments, local users were not restricted from
executing commands from a Server-Side-Include script as intended.
(CVE-2009-1195)

Users must restart httpd for this update to take effect.

See also :

http://www.nessus.org/u?f3a249d7

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60591 ()

Bugtraq ID:

CVE ID: CVE-2008-1678
CVE-2009-1195