httpd-2.2.15-26.0.1.AXS4
エラータID: AXSA:2013-123:02
リリース日:
2013/03/06 Wednesday - 12:31
題名:
httpd-2.2.15-26.0.1.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Apache HTTP Server の mod_negotiation モジュールにはクロスサイトスクリプティング (XSS) 脆弱性が存在し，XSS シーケンスとファイルの拡張子を含む名前を持つファイルをアップロードすることによって，リモートの攻撃者が任意の Web スクリプトや HTML を注入する脆弱性があります。(CVE-2008-0455)
- Apache HTTP Server の mod_negotiation モジュールの mod_negotiation.c の make_variant_list 関数には，MultiViews オプションが有効な場合，複数のクロスサイトスクリプティング (XSS) 脆弱性が存在し，巧妙に細工されたファイル名によって，リモートの攻撃者が任意の Web スクリプトあるいは HTML を注入する脆弱性があります。(CVE-2012-2687)
- Apache HTTP Server の mod_proxy_ajp モジュールは，長いリクエスト処理時間を検知すると，worker ノードをエラー状態にしてしまい，過度のリクエストによってリモートの攻撃者がサービス拒否 (worker の消費) を引き起こす脆弱性があります。 (CVE-2012-4557)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2008-0455
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.
CVE-2012-2687
Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
CVE-2012-4557
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
追加情報:
N/A
ダウンロード:
SRPMS
- httpd-2.2.15-26.0.1.AXS4.src.rpm
MD5: 87cf2e750efa5b5db7ab5dad25574a1c
SHA-256: e04652d85533f9474b587e7dceb005f9564f65efd8b3ad953930c3172b1a6af1
Size: 6.39 MB
Asianux Server 4 for x86
- httpd-2.2.15-26.0.1.AXS4.i686.rpm
MD5: 1f36d51eabeec5ec15d86e190ecb2920
SHA-256: bb2127b71d472df8c1b0675d2052816bcc14e32d63a6c72dc25e6277fe02791f
Size: 826.51 kB - httpd-devel-2.2.15-26.0.1.AXS4.i686.rpm
MD5: e0c18d236fb18db0708f0d1840831f59
SHA-256: e00ac58a7024c7c462201f8ebc9915eb67499619d7a3e9be0fc12cd10215b7aa
Size: 149.39 kB - httpd-manual-2.2.15-26.0.1.AXS4.noarch.rpm
MD5: 25641fc545fcbd419153e1ad464f6286
SHA-256: 886746476a38ccd72d461ef497850000c9253ce43ab75590271a8510c6a834c5
Size: 782.94 kB - httpd-tools-2.2.15-26.0.1.AXS4.i686.rpm
MD5: 098ad1642d4bd7aabecd43a18065e9d6
SHA-256: 38218a45c29683c05780deaed510318c961247665b3f319063198148d5ef3232
Size: 72.64 kB - mod_ssl-2.2.15-26.0.1.AXS4.i686.rpm
MD5: 933cc6873c5cc29d26aaabd722a2d1de
SHA-256: 2cff6c922dcc134af1ff157166bb14dac85d172ace16c64551c01a394c4cbdd7
Size: 90.48 kB
Asianux Server 4 for x86_64
- httpd-2.2.15-26.0.1.AXS4.x86_64.rpm
MD5: e577e48b793c0b0bd686a0f7e3d555b7
SHA-256: ff2b84d4ec4540fbe68bd1383fe1a5f14fed5f00259588575e3b7485910a6d94
Size: 820.39 kB - httpd-devel-2.2.15-26.0.1.AXS4.x86_64.rpm
MD5: c26bb3d7f7b83176f62903666ef23877
SHA-256: 391789e7f9b6fd6a1801dd4c250db546b44f9abc0956ac6fb6c2b761c5b023bb
Size: 148.93 kB - httpd-manual-2.2.15-26.0.1.AXS4.noarch.rpm
MD5: ac106cb86baad0619a643749384e23e1
SHA-256: b83dbdddeb55ea26c6af6f0592e9295071ea879c90becd5943d5ea223f0bb249
Size: 782.41 kB - httpd-tools-2.2.15-26.0.1.AXS4.x86_64.rpm
MD5: 41766e8bd66e6ec73048c05b98fb4df4
SHA-256: aab40451d0fc596efba96e3bd3b8002432946b67b8ac60ec5240418f745c3b89
Size: 71.57 kB - mod_ssl-2.2.15-26.0.1.AXS4.x86_64.rpm
MD5: 47d64bdb7938bab5f800eabf8793da17
SHA-256: 0c6ca474084d5b742bcf35ec206ff9ade143959d3291ff4a178e1118e3b68946
Size: 89.34 kB - httpd-devel-2.2.15-26.0.1.AXS4.i686.rpm
MD5: e0c18d236fb18db0708f0d1840831f59
SHA-256: e00ac58a7024c7c462201f8ebc9915eb67499619d7a3e9be0fc12cd10215b7aa
Size: 149.39 kB