Web Browser 로는 FTP 접속이 불가능 합니다.

문서번호 : 1202570165
업데이트 : 2008.02.10


상세내용

- apache 1.3.41 update
- modssl 2.8.31 update

- 보안버그 수정 사항

. CVE-2007-6388
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server
2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the
server-status page is enabled, allows remote attackers to inject arbitrary web
script or HTML via unspecified vectors.

. CVE-2007-5000
Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache
HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap
module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to
inject arbitrary web script or HTML via unspecified vectors.

. CVE-2007-3847
The date handling code in modules/proxy/proxy_util.c (mod_proxy) in Apache 2.3.0,
when using a threaded MPM, allows remote origin servers to cause a denial of service
(caching forward proxy process crash) via crafted date headers that trigger a buffer
over-read.


modssl 설치시에, /etc/httpd/conf/conf.d/ssl.conf 가 /etc/httpd/conf/module.d/
로 이동 됨.


Autoupdates 지원 : Packages System
    pkgadd -F "apache*"
    pkgadd -F "mod_ssl*"


update 패키지

  RPMS :

    . apache-1.3.41-1.i686.rpm
    . apache-devel-1.3.41-1.i686.rpm
    . mod_ssl-2.8.31-1.3.41-1.i686.rpm
    . mod_ssl-sxnet-2.8.31-1.3.41-1.i686.rpm

  SRPMS :

    . mod_ssl-2.8.31-1.3.41-1.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6388
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5000
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847