CESA-2008:0006: RHSA-2008:0006

Description

Moderate: httpd security updateThe Apache HTTP Server is a popular Web server.A flaw was found in the mod_imap module. On sites where mod_imap wasenabled and an imagemap file was publicly available, a cross-site scriptingattack was possible. (CVE-2007-5000)A flaw was found in the mod_autoindex module. On sites where directorylistings are used, and the "AddDefaultCharset" directive has been removedfrom the configuration, a cross-site scripting attack was possible againstWeb browsers which do not correctly derive the response character setfollowing the rules in RFC 2616. (CVE-2007-4465)A flaw was found in the mod_status module. On sites where mod_status wasenabled and the status pages were publicly available, a cross-sitescripting attack was possible. (CVE-2007-6388)A flaw was found in the mod_proxy_ftp module. On sites where mod_proxy_ftpwas enabled and a forward proxy was configured, a cross-site scriptingattack was possible against Web browsers which do not correctly derive theresponse character set following the rules in RFC 2616. (CVE-2008-0005)Users of Apache httpd should upgrade to these updated packages, whichcontain backported patches to resolve these issues. Users should restarthttpd after installing this update.