Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:072)

High Nessus Plugin ID 13972


The remote Mandrake Linux host is missing a security update.


A cross-site scripting vulnerability was discovered in mod_ssl by Joe Orton. This only affects servers using a combination of wildcard DNS and 'UseCanonicalName off' (which is not the default in Mandrake Linux). With this setting turned off, Apache will attempt to use the hostname:port that the client supplies, which is where the problem comes into play. With this setting turned on (the default), Apache constructs a self-referencing URL and will use ServerName and Port to form the canonical name.

It is recommended that all users upgrade, regardless of the setting of the 'UseCanonicalName' configuration option.


Update the affected mod_ssl package.

Plugin Details

Severity: High

ID: 13972

File Name: mandrake_MDKSA-2002-072.nasl

Version: $Revision: 1.14 $

Type: local

Published: 2004/07/31

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:mod_ssl, cpe:/o:mandrakesoft:mandrake_linux:7.2, cpe:/o:mandrakesoft:mandrake_linux:8.0, cpe:/o:mandrakesoft:mandrake_linux:8.1, cpe:/o:mandrakesoft:mandrake_linux:8.2, cpe:/o:mandrakesoft:mandrake_linux:9.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2002/10/24

Reference Information

CVE: CVE-2002-1157

MDKSA: 2002:072