[ MDVSA-2008:014 ] - Updated apache 1.3.x packages fix multiple vulnerabilities

[security@xxxxxxxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:014
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : apache
 Date    : January 16, 2008
 Affected: Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 A number of vulnerabilities were found and fixed in the Apache 1.3.x
 packages:
 
 A flaw found in the mod_autoindex module could lead to a cross-site
 scripting attack on sites where mod_autoindex was enabled and the
 AddDefaultCharset directive was removed from the configuration,
 against web browsers that did not correctly derive the response
 character set following the rules in RFC 2616 (CVE-2007-4465).
 
 A flaw found in the mod_imagemap module could lead to a cross-site
 scripting attack on sites where mod_imagemap was enabled and an
 imagemap file was publically available (CVE-2007-5000).
 
 A flaw found in the mod_status module could lead to a cross-site
 scripting attack on sites where mod_status was enabled and the status
 pages were publically available (CVE-2007-6388).
 
 A flaw found in the mod_proxy_ftp module could lead to a cross-site
 scripting attack against web browsers which do not correctly derive
 the response character set following the rules in RFC 2616, on sites
 where the mod_proxy_ftp module was enabled (CVE-2008-0005).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4465
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005
 _______________________________________________________________________
 
 Updated Packages:
 
 Corporate 3.0:
 c9c5c7f93bb0fa94835c5594bf210549  
corporate/3.0/i586/apache-1.3.29-1.7.C30mdk.i586.rpm
 bddc9c4aad23e8601d8a836e92e8808a  
corporate/3.0/i586/apache-devel-1.3.29-1.7.C30mdk.i586.rpm
 cc176ace02cacae3749540e61e495234  
corporate/3.0/i586/apache-modules-1.3.29-1.7.C30mdk.i586.rpm
 9289b7b9e19b966f15eea0fe8e183d3e  
corporate/3.0/i586/apache-source-1.3.29-1.7.C30mdk.i586.rpm 
 8efcd88ed1620fc9dd2f708af8f44a07  
corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 59ca425ea89cfb2d67cccec0da61aa50  
corporate/3.0/x86_64/apache-1.3.29-1.7.C30mdk.x86_64.rpm
 a8ff18539221b129855cf9255fe6a68c  
corporate/3.0/x86_64/apache-devel-1.3.29-1.7.C30mdk.x86_64.rpm
 4c65bba7f8538b1d50eab4fdfc161fb4  
corporate/3.0/x86_64/apache-modules-1.3.29-1.7.C30mdk.x86_64.rpm
 28bb131ffe555d1e945c824a109f1724  
corporate/3.0/x86_64/apache-source-1.3.29-1.7.C30mdk.x86_64.rpm 
 8efcd88ed1620fc9dd2f708af8f44a07  
corporate/3.0/SRPMS/apache-1.3.29-1.7.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHjleYmqjQ0CJFipgRAmsPAKCl2buf2vYqjKIRwmNJBE9Uw2xPdACg0m4J
rg2ebG2n+L9LsBYZApkisVE=
=DgHQ
-----END PGP SIGNATURE-----