RHEL 6 : httpd (RHSA-2013:0512)

medium Nessus Plugin ID 64761

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0512 advisory.

The httpd packages contain the Apache HTTP Server (httpd), which is the namesake project of The Apache Software Foundation.

An input sanitization flaw was found in the mod_negotiation Apache HTTP Server module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use this flaw to conduct cross-site scripting attacks against users visiting the site. (CVE-2008-0455, CVE-2012-2687)

It was discovered that mod_proxy_ajp, when used in configurations with mod_proxy in load balancer mode, would mark a back-end server as failed when request processing timed out, even when a previous AJP (Apache JServ Protocol) CPing request was responded to by the back-end. A remote attacker able to make a back-end use an excessive amount of time to process a request could cause mod_proxy to not send requests to back-end AJP servers for the retry timeout period or until all back-end servers were marked as failed. (CVE-2012-4557)

These updated httpd packages include numerous bug fixes and enhancements.
Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes.

All users of httpd are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing the updated packages, the httpd daemon will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?03f89d6f

http://www.nessus.org/u?da6c70c5

https://access.redhat.com/errata/RHSA-2013:0512

https://access.redhat.com/security/updates/classification/#low

https://bugzilla.redhat.com/show_bug.cgi?id=757735

https://bugzilla.redhat.com/show_bug.cgi?id=757739

https://bugzilla.redhat.com/show_bug.cgi?id=805720

https://bugzilla.redhat.com/show_bug.cgi?id=805810

https://bugzilla.redhat.com/show_bug.cgi?id=828896

https://bugzilla.redhat.com/show_bug.cgi?id=829689

https://bugzilla.redhat.com/show_bug.cgi?id=842376

https://bugzilla.redhat.com/show_bug.cgi?id=848954

https://bugzilla.redhat.com/show_bug.cgi?id=850794

https://bugzilla.redhat.com/show_bug.cgi?id=867745

https://bugzilla.redhat.com/show_bug.cgi?id=868283

https://bugzilla.redhat.com/show_bug.cgi?id=871685

https://bugzilla.redhat.com/show_bug.cgi?id=876923

Plugin Details

Severity: Medium

ID: 64761

File Name: redhat-RHSA-2013-0512.nasl

Version: 1.21

Type: local

Agent: unix

Published: 2/21/2013

Updated: 4/15/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.2

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2008-0455

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2012-2687

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:httpd-devel, p-cpe:/a:redhat:enterprise_linux:mod_ssl, p-cpe:/a:redhat:enterprise_linux:httpd-tools, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:httpd-manual, p-cpe:/a:redhat:enterprise_linux:httpd

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/21/2013

Vulnerability Publication Date: 1/24/2008

Reference Information

CVE: CVE-2008-0455, CVE-2012-2687, CVE-2012-4557

BID: 27409, 55131, 56753

CWE: 79

RHSA: 2013:0512