Scientific Linux Security Update : httpd on SL5.x i386/x86_64

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

Input sanitization flaws were found in the mod_negotiation module. A
remote attacker able to upload or create files with arbitrary names in
a directory that has the MultiViews options enabled, could use these
flaws to conduct cross-site scripting and HTTP response splitting
attacks against users visiting the site. (CVE-2008-0455,
CVE-2008-0456, CVE-2012-2687)

Bug fixes :

- Previously, no check was made to see if the
/etc/pki/tls/private/localhost.key file was a valid key
prior to running the '%post' script for the 'mod_ssl'
package. Consequently, when
/etc/pki/tls/certs/localhost.crt did not exist and
'localhost.key' was present but invalid, upgrading the
Apache HTTP Server daemon (httpd) with mod_ssl failed.
The '%post' script has been fixed to test for an
existing SSL key. As a result, upgrading httpd with
mod_ssl now proceeds as expected.

- The 'mod_ssl' module did not support operation under
FIPS mode. Consequently, when operating Scientific Linux
5 with FIPS mode enabled, httpd failed to start. An
upstream patch has been applied to disable non-FIPS
functionality if operating under FIPS mode and httpd now
starts as expected.

- Prior to this update, httpd exit status codes were not
Linux Standard Base (LSB) compliant. When the command
'service httpd reload' was run and httpd failed, the
exit status code returned was '0' and not in the range 1
to 6 as expected. A patch has been applied to the init
script and httpd now returns '1' as an exit status code.

- Chunked Transfer Coding is described in RFC 2616.
Previously, the Apache server did not correctly handle a
chunked encoded POST request with a 'chunk- size' or
'chunk-extension' value of 32 bytes or more.
Consequently, when such a POST request was made the
server did not respond. An upstream patch has been
applied and the problem no longer occurs.

- Due to a regression, when mod_cache received a
non-cacheable 304 response, the headers were served
incorrectly. Consequently, compressed data could be
returned to the client without the cached headers to
indicate the data was compressed. An upstream patch has
been applied to merge response and cached headers before
data from the cache is served to the client. As a
result, cached data is now correctly interpreted by the
client.

- In a proxy configuration, certain response-line strings
were not handled correctly. If a response-line without a
'description' string was received from the origin
server, for a non-standard status code, such as the
'450' status code, a '500 Internal Server Error' would
be returned to the client. This bug has been fixed so
that the original response line is returned to the
client.

Enhancements :

- The configuration directive 'LDAPReferrals' is now
supported in addition to the previously introduced
'LDAPChaseReferrals'.

- The AJP support module for 'mod_proxy', 'mod_proxy_ajp',
now supports the 'ProxyErrorOverride' directive.
Consequently, it is now possible to configure customized
error pages for web applications running on a backend
server accessed via AJP.

- The '%posttrans' scriptlet which automatically restarts
the httpd service after a package upgrade can now be
disabled. If the file /etc/sysconfig/httpd-
disable-posttrans exists, the scriptlet will not restart
the daemon.

- The output of 'httpd -S' now includes configured alias
names for each virtual host.

- New certificate variable names are now exposed by
'mod_ssl' using the '_DN_userID' suffix, such as
'SSL_CLIENT_S_DN_userID', which use the commonly used
object identifier (OID) definition of 'userID', OID
0.9.2342.19200300.100.1.1.

See also :

http://www.nessus.org/u?bc482cdc

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 63597 ()

Bugtraq ID:

CVE ID: CVE-2008-0455
CVE-2008-0456
CVE-2012-2687