Detections
Analytics
Scientific Linux Security Update : httpd on SL5.x i386/x86_64 (20140403)
medium Nessus Plugin ID 73368
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2013-6438)A buffer over-read flaw was found in the httpd mod_log_config module.
In configurations where cookie logging is enabled (on Scientific Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098)
After installing the updated packages, the httpd daemon will be restarted automatically.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 73368
File Name: sl_20140403_httpd_on_SL5_x.nasl
Version: 1.7
Type: local
Agent: unix
Published: 4/7/2014
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 1.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:httpd, p-cpe:/a:fermilab:scientific_linux:httpd-debuginfo, p-cpe:/a:fermilab:scientific_linux:httpd-devel, p-cpe:/a:fermilab:scientific_linux:httpd-manual, p-cpe:/a:fermilab:scientific_linux:mod_ssl, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 4/3/2014
Vulnerability Publication Date: 3/18/2014
Reference Information
CVE: CVE-2013-6438, CVE-2014-0098