Rapid7 Vulnerability & Exploit Database

RHSA-2009:1148: httpd security update

Back to Search

RHSA-2009:1148: httpd security update

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:N/I:N/A:C)
Published
07/10/2009
Created
07/25/2018
Added
09/12/2009
Modified
07/04/2017

Description

The Apache HTTP Server is a popular Web server.A denial of service flaw was found in the Apache mod_proxy module when itwas used as a reverse proxy. A remote attacker could use this flaw to forcea proxy process to consume large amounts of CPU time. (CVE-2009-1890)A denial of service flaw was found in the Apache mod_deflate module. Thismodule continued to compress large files until compression was complete,even if the network connection that requested the content was closed beforecompression completed. This would cause mod_deflate to consume largeamounts of CPU if mod_deflate was enabled for a large file. (CVE-2009-1891)All httpd users should upgrade to these updated packages, which containbackported patches to correct these issues. After installing the updatedpackages, the httpd daemon must be restarted for the update to take effect.

Solution(s)

  • redhat-upgrade-httpd
  • redhat-upgrade-httpd-devel
  • redhat-upgrade-httpd-manual
  • redhat-upgrade-mod_ssl

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;