Mandrake Linux Security Advisory : apache2 (MDKSA-2004:096)

This script is Copyright (C) 2004-2014 Tenable Network Security, Inc.


Synopsis :

The remote Mandrake Linux host is missing one or more security
updates.

Description :

Two Denial of Service conditions were discovered in the input filter
of mod_ssl, the module that enables apache to handle HTTPS requests.

Another vulnerability was discovered by the ASF security team using
the Codenomicon HTTP Test Tool. This vulnerability, in the apr-util
library, can possibly lead to arbitrary code execution if certain
non-default conditions are met (enabling the AP_ENABLE_EXCEPTION_HOOK
define).

As well, the SITIC have discovered a buffer overflow when Apache
expands environment variables in configuration files such as .htaccess
and httpd.conf, which can lead to possible privilege escalation. This
can only be done, however, if an attacker is able to place malicious
configuration files on the server.

Finally, a crash condition was discovered in the mod_dav module by
Julian Reschke, where sending a LOCK refresh request to an indirectly
locked resource could crash the server.

The updated packages have been patched to protect against these
vulnerabilities.

See also :

http://www.uniras.gov.uk/vuls/2004/403518/index.htm

Solution :

Update the affected packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 14752 (mandrake_MDKSA-2004-096.nasl)

Bugtraq ID:

CVE ID: CVE-2004-0747
CVE-2004-0748
CVE-2004-0751
CVE-2004-0783
CVE-2004-0786
CVE-2004-0809

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now