Detections
Analytics

Mandriva Linux Security Advisory : apache (MDVSA-2010:153)

medium Nessus Plugin ID 48347

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities has been found and corrected in apache :

The mod_cache and mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path (CVE-2010-1452).

mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE:
this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions (CVE-2010-2791).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90

The updated packages have been patched to correct these issues.

Solution

Update the affected packages.

See Also

http://httpd.apache.org/security/vulnerabilities_22.html

Plugin Details

Severity: Medium

ID: 48347

File Name: mandriva_MDVSA-2010-153.nasl

Version: 1.16

Type: local

Published: 8/17/2010

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:apache-mod_mem_cache, p-cpe:/a:mandriva:linux:apache-mod_ssl, p-cpe:/a:mandriva:linux:apache-mod_dbd, p-cpe:/a:mandriva:linux:apache-mod_authn_dbd, p-cpe:/a:mandriva:linux:apache-mpm-peruser, p-cpe:/a:mandriva:linux:apache-mod_proxy, p-cpe:/a:mandriva:linux:apache-mod_ldap, p-cpe:/a:mandriva:linux:apache-mod_cache, p-cpe:/a:mandriva:linux:apache-mod_deflate, p-cpe:/a:mandriva:linux:apache-mpm-worker, p-cpe:/a:mandriva:linux:apache-devel, p-cpe:/a:mandriva:linux:apache-mod_disk_cache, p-cpe:/a:mandriva:linux:apache-mod_userdir, p-cpe:/a:mandriva:linux:apache-htcacheclean, p-cpe:/a:mandriva:linux:apache-base, p-cpe:/a:mandriva:linux:apache-mod_proxy_ajp, p-cpe:/a:mandriva:linux:apache-mpm-prefork, p-cpe:/a:mandriva:linux:apache-mod_file_cache, p-cpe:/a:mandriva:linux:apache-mpm-itk, p-cpe:/a:mandriva:linux:apache-source, p-cpe:/a:mandriva:linux:apache-modules, p-cpe:/a:mandriva:linux:apache-mpm-event, p-cpe:/a:mandriva:linux:apache-mod_dav, cpe:/o:mandriva:linux:2009.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 8/16/2010

Reference Information

CVE: CVE-2010-1452, CVE-2010-2791

MDVSA: 2010:153