Detections
Analytics
Debian DSA-2035-1 : apache2 - multiple issues
medium Nessus Plugin ID 45557
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Two issues have been found in the Apache HTTPD web server :- CVE-2010-0408 mod_proxy_ajp would return the wrong status code if it encountered an error, causing a backend server to be put into an error state until the retry timeout expired. A remote attacker could send malicious requests to trigger this issue, resulting in denial of service.
- CVE-2010-0434 A flaw in the core subrequest process code was found, which could lead to a daemon crash (segfault) or disclosure of sensitive information if the headers of a subrequest were modified by modules such as mod_headers.
Solution
Upgrade the apache2 and apache2-mpm-itk packages.For the stable distribution (lenny), these problems have been fixed in version 2.2.9-10+lenny7.
This advisory also provides updated apache2-mpm-itk packages which have been recompiled against the new apache2 packages.
See Also
https://security-tracker.debian.org/tracker/CVE-2010-0408
Plugin Details
Severity: Medium
ID: 45557
File Name: debian_DSA-2035.nasl
Version: 1.22
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 4/19/2010
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.5
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:apache2, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 4/17/2010
Reference Information
CVE: CVE-2010-0408, CVE-2010-0434
CWE: 200
DSA: 2035