Detections
Analytics

Mandriva Linux Security Advisory : apache (MDVSA-2012:154-1)

medium Nessus Plugin ID 62386

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities has been found and corrected in apache (ASF HTTPD) :

Insecure handling of LD_LIBRARY_PATH was found that could lead to the current working directory to be searched for DSOs. This could allow a local user to execute code as root if an administrator runs apachectl from an untrusted directory (CVE-2012-0883).

Possible XSS for sites which use mod_negotiation and allow untrusted uploads to locations which have MultiViews enabled (CVE-2012-2687).

The updated packages have been upgraded to the latest 2.2.23 version which is not vulnerable to these issues.

Update :

Packages for Mandriva Linux 2011 is also being provided.

Solution

Update the affected packages.

See Also

http://httpd.apache.org/security/vulnerabilities_22.html

http://www.apache.org/dist/httpd/CHANGES_2.2.23

Plugin Details

Severity: Medium

ID: 62386

File Name: mandriva_MDVSA-2012-154.nasl

Version: 1.16

Type: local

Published: 10/2/2012

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 5.1

Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:apache-base, p-cpe:/a:mandriva:linux:apache-conf, p-cpe:/a:mandriva:linux:apache-devel, p-cpe:/a:mandriva:linux:apache-doc, p-cpe:/a:mandriva:linux:apache-htcacheclean, p-cpe:/a:mandriva:linux:apache-mod_authn_dbd, p-cpe:/a:mandriva:linux:apache-mod_cache, p-cpe:/a:mandriva:linux:apache-mod_dav, p-cpe:/a:mandriva:linux:apache-mod_dbd, p-cpe:/a:mandriva:linux:apache-mod_deflate, p-cpe:/a:mandriva:linux:apache-mod_disk_cache, p-cpe:/a:mandriva:linux:apache-mod_file_cache, p-cpe:/a:mandriva:linux:apache-mod_ldap, p-cpe:/a:mandriva:linux:apache-mod_mem_cache, p-cpe:/a:mandriva:linux:apache-mod_proxy, p-cpe:/a:mandriva:linux:apache-mod_proxy_ajp, p-cpe:/a:mandriva:linux:apache-mod_proxy_scgi, p-cpe:/a:mandriva:linux:apache-mod_reqtimeout, p-cpe:/a:mandriva:linux:apache-mod_ssl, p-cpe:/a:mandriva:linux:apache-mod_suexec, p-cpe:/a:mandriva:linux:apache-mod_userdir, p-cpe:/a:mandriva:linux:apache-modules, p-cpe:/a:mandriva:linux:apache-mpm-event, p-cpe:/a:mandriva:linux:apache-mpm-itk, p-cpe:/a:mandriva:linux:apache-mpm-peruser, p-cpe:/a:mandriva:linux:apache-mpm-prefork, p-cpe:/a:mandriva:linux:apache-mpm-worker, p-cpe:/a:mandriva:linux:apache-source, cpe:/o:mandriva:linux:2011

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/1/2012

Reference Information

CVE: CVE-2012-0883, CVE-2012-2687

BID: 53046, 55131

MDVSA: 2012:154-1