You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by mj...@apache.org on 2008/01/16 17:27:36 UTC
svn commit: r612501 - in /httpd/site/trunk:
docs/security/vulnerabilities-oval.xml
docs/security/vulnerabilities_20.html docs/security/vulnerabilities_22.html
xdocs/security/vulnerabilities-httpd.xml
Author: mjc
Date: Wed Jan 16 08:27:34 2008
New Revision: 612501
URL: http://svn.apache.org/viewvc?rev=612501&view=rev
Log:
Add the missing CVE-2008-0005 issue, although not strictly a real vulnerability
in httpd
Modified:
httpd/site/trunk/docs/security/vulnerabilities-oval.xml
httpd/site/trunk/docs/security/vulnerabilities_20.html
httpd/site/trunk/docs/security/vulnerabilities_22.html
httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml
Modified: httpd/site/trunk/docs/security/vulnerabilities-oval.xml
URL: http://svn.apache.org/viewvc/httpd/site/trunk/docs/security/vulnerabilities-oval.xml?rev=612501&r1=612500&r2=612501&view=diff
==============================================================================
--- httpd/site/trunk/docs/security/vulnerabilities-oval.xml (original)
+++ httpd/site/trunk/docs/security/vulnerabilities-oval.xml Wed Jan 16 08:27:34 2008
@@ -5,60 +5,6 @@
<oval:timestamp>2005-10-12T18:13:45</oval:timestamp>
</generator>
<definitions>
-<definition id="oval:org.apache.httpd:def:20076422" version="1" class="vulnerability">
-<metadata>
-<title>mod_proxy_balancer DoS</title>
-<reference source="CVE" ref_id="CVE-2007-6422" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6422"/>
-<description>
-A flaw was found in the mod_proxy_balancer module. On sites where
-mod_proxy_balancer is enabled, an authorized user could send a carefully
-crafted request that would cause the Apache child process handling that
-request to crash. This could lead to a denial of service if using a
-threaded Multi-Processing Module. </description>
-<apache_httpd_repository>
-<public>20080102</public>
-<reported>20071212</reported>
-<released/>
-<severity level="4">low</severity>
-</apache_httpd_repository>
-</metadata>
-<criteria operator="OR">
-<criteria operator="OR">
-<criterion test_ref="oval:org.apache.httpd:tst:226" comment="the version of httpd is 2.2.6"/>
-<criterion test_ref="oval:org.apache.httpd:tst:225" comment="the version of httpd is 2.2.5"/>
-<criterion test_ref="oval:org.apache.httpd:tst:224" comment="the version of httpd is 2.2.4"/>
-<criterion test_ref="oval:org.apache.httpd:tst:223" comment="the version of httpd is 2.2.3"/>
-<criterion test_ref="oval:org.apache.httpd:tst:222" comment="the version of httpd is 2.2.2"/>
-<criterion test_ref="oval:org.apache.httpd:tst:220" comment="the version of httpd is 2.2.0"/>
-</criteria>
-</criteria>
-</definition>
-<definition id="oval:org.apache.httpd:def:20076421" version="1" class="vulnerability">
-<metadata>
-<title>mod_proxy_balancer XSS</title>
-<reference source="CVE" ref_id="CVE-2007-6421" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6421"/>
-<description>
-A flaw was found in the mod_proxy_balancer module. On sites where
-mod_proxy_balancer is enabled, a cross-site scripting attack against an
-authorized user is possible. </description>
-<apache_httpd_repository>
-<public>20080102</public>
-<reported>20071212</reported>
-<released/>
-<severity level="4">low</severity>
-</apache_httpd_repository>
-</metadata>
-<criteria operator="OR">
-<criteria operator="OR">
-<criterion test_ref="oval:org.apache.httpd:tst:226" comment="the version of httpd is 2.2.6"/>
-<criterion test_ref="oval:org.apache.httpd:tst:225" comment="the version of httpd is 2.2.5"/>
-<criterion test_ref="oval:org.apache.httpd:tst:224" comment="the version of httpd is 2.2.4"/>
-<criterion test_ref="oval:org.apache.httpd:tst:223" comment="the version of httpd is 2.2.3"/>
-<criterion test_ref="oval:org.apache.httpd:tst:222" comment="the version of httpd is 2.2.2"/>
-<criterion test_ref="oval:org.apache.httpd:tst:220" comment="the version of httpd is 2.2.0"/>
-</criteria>
-</criteria>
-</definition>
<definition id="oval:org.apache.httpd:def:20076388" version="1" class="vulnerability">
<metadata>
<title>mod_status XSS</title>
@@ -216,6 +162,113 @@
</criteria>
</criteria>
</definition>
+<definition id="oval:org.apache.httpd:def:20080005" version="1" class="vulnerability">
+<metadata>
+<title>mod_proxy_ftp UTF-7 XSS</title>
+<reference source="CVE" ref_id="CVE-2008-0005" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005"/>
+<description>
+A workaround was added in the mod_proxy_ftp module. On sites where
+mod_proxy_ftp is enabled and a forward proxy is configured, a
+cross-site scripting attack is possible against Web browsers which do
+not correctly derive the response character set following the rules in
+RFC 2616.
+</description>
+<apache_httpd_repository>
+<public>20080108</public>
+<reported>20071215</reported>
+<released/>
+<severity level="4">low</severity>
+</apache_httpd_repository>
+</metadata>
+<criteria operator="OR">
+<criteria operator="OR">
+<criterion test_ref="oval:org.apache.httpd:tst:2061" comment="the version of httpd is 2.0.61"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2059" comment="the version of httpd is 2.0.59"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2058" comment="the version of httpd is 2.0.58"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2055" comment="the version of httpd is 2.0.55"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2054" comment="the version of httpd is 2.0.54"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2053" comment="the version of httpd is 2.0.53"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2052" comment="the version of httpd is 2.0.52"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2051" comment="the version of httpd is 2.0.51"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2050" comment="the version of httpd is 2.0.50"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2049" comment="the version of httpd is 2.0.49"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2048" comment="the version of httpd is 2.0.48"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2047" comment="the version of httpd is 2.0.47"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2046" comment="the version of httpd is 2.0.46"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2045" comment="the version of httpd is 2.0.45"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2044" comment="the version of httpd is 2.0.44"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2043" comment="the version of httpd is 2.0.43"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2042" comment="the version of httpd is 2.0.42"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2040" comment="the version of httpd is 2.0.40"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2039" comment="the version of httpd is 2.0.39"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2037" comment="the version of httpd is 2.0.37"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2036" comment="the version of httpd is 2.0.36"/>
+<criterion test_ref="oval:org.apache.httpd:tst:2035" comment="the version of httpd is 2.0.35"/>
+</criteria>
+<criteria operator="OR">
+<criterion test_ref="oval:org.apache.httpd:tst:226" comment="the version of httpd is 2.2.6"/>
+<criterion test_ref="oval:org.apache.httpd:tst:225" comment="the version of httpd is 2.2.5"/>
+<criterion test_ref="oval:org.apache.httpd:tst:224" comment="the version of httpd is 2.2.4"/>
+<criterion test_ref="oval:org.apache.httpd:tst:223" comment="the version of httpd is 2.2.3"/>
+<criterion test_ref="oval:org.apache.httpd:tst:222" comment="the version of httpd is 2.2.2"/>
+<criterion test_ref="oval:org.apache.httpd:tst:220" comment="the version of httpd is 2.2.0"/>
+</criteria>
+</criteria>
+</definition>
+<definition id="oval:org.apache.httpd:def:20076422" version="1" class="vulnerability">
+<metadata>
+<title>mod_proxy_balancer DoS</title>
+<reference source="CVE" ref_id="CVE-2007-6422" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6422"/>
+<description>
+A flaw was found in the mod_proxy_balancer module. On sites where
+mod_proxy_balancer is enabled, an authorized user could send a carefully
+crafted request that would cause the Apache child process handling that
+request to crash. This could lead to a denial of service if using a
+threaded Multi-Processing Module. </description>
+<apache_httpd_repository>
+<public>20080102</public>
+<reported>20071212</reported>
+<released/>
+<severity level="4">low</severity>
+</apache_httpd_repository>
+</metadata>
+<criteria operator="OR">
+<criteria operator="OR">
+<criterion test_ref="oval:org.apache.httpd:tst:226" comment="the version of httpd is 2.2.6"/>
+<criterion test_ref="oval:org.apache.httpd:tst:225" comment="the version of httpd is 2.2.5"/>
+<criterion test_ref="oval:org.apache.httpd:tst:224" comment="the version of httpd is 2.2.4"/>
+<criterion test_ref="oval:org.apache.httpd:tst:223" comment="the version of httpd is 2.2.3"/>
+<criterion test_ref="oval:org.apache.httpd:tst:222" comment="the version of httpd is 2.2.2"/>
+<criterion test_ref="oval:org.apache.httpd:tst:220" comment="the version of httpd is 2.2.0"/>
+</criteria>
+</criteria>
+</definition>
+<definition id="oval:org.apache.httpd:def:20076421" version="1" class="vulnerability">
+<metadata>
+<title>mod_proxy_balancer XSS</title>
+<reference source="CVE" ref_id="CVE-2007-6421" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6421"/>
+<description>
+A flaw was found in the mod_proxy_balancer module. On sites where
+mod_proxy_balancer is enabled, a cross-site scripting attack against an
+authorized user is possible. </description>
+<apache_httpd_repository>
+<public>20080102</public>
+<reported>20071212</reported>
+<released/>
+<severity level="4">low</severity>
+</apache_httpd_repository>
+</metadata>
+<criteria operator="OR">
+<criteria operator="OR">
+<criterion test_ref="oval:org.apache.httpd:tst:226" comment="the version of httpd is 2.2.6"/>
+<criterion test_ref="oval:org.apache.httpd:tst:225" comment="the version of httpd is 2.2.5"/>
+<criterion test_ref="oval:org.apache.httpd:tst:224" comment="the version of httpd is 2.2.4"/>
+<criterion test_ref="oval:org.apache.httpd:tst:223" comment="the version of httpd is 2.2.3"/>
+<criterion test_ref="oval:org.apache.httpd:tst:222" comment="the version of httpd is 2.2.2"/>
+<criterion test_ref="oval:org.apache.httpd:tst:220" comment="the version of httpd is 2.2.0"/>
+</criteria>
+</criteria>
+</definition>
<definition id="oval:org.apache.httpd:def:20073847" version="1" class="vulnerability">
<metadata>
<title>mod_proxy crash</title>
@@ -666,7 +719,7 @@
</description>
<apache_httpd_repository>
<public>20060508</public>
-<reported/>
+<reported></reported>
<released>20060501</released>
<severity level="3">moderate</severity>
</apache_httpd_repository>
Modified: httpd/site/trunk/docs/security/vulnerabilities_20.html
URL: http://svn.apache.org/viewvc/httpd/site/trunk/docs/security/vulnerabilities_20.html?rev=612501&r1=612500&r2=612501&view=diff
==============================================================================
--- httpd/site/trunk/docs/security/vulnerabilities_20.html (original)
+++ httpd/site/trunk/docs/security/vulnerabilities_20.html Wed Jan 16 08:27:34 2008
@@ -94,6 +94,25 @@
<blockquote>
<dl>
<dd>
+<b>low: </b>
+<b>
+<name name="CVE-2008-0005">mod_proxy_ftp UTF-7 XSS</name>
+</b>
+<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005">CVE-2008-0005</a>
+<p>
+A workaround was added in the mod_proxy_ftp module. On sites where
+mod_proxy_ftp is enabled and a forward proxy is configured, a
+cross-site scripting attack is possible against Web browsers which do
+not correctly derive the response character set following the rules in
+RFC 2616.
+</p>
+</dd>
+<dd />
+<dd>
+ Affects:
+ 2.0.61, 2.0.59, 2.0.58, 2.0.55, 2.0.54, 2.0.53, 2.0.52, 2.0.51, 2.0.50, 2.0.49, 2.0.48, 2.0.47, 2.0.46, 2.0.45, 2.0.44, 2.0.43, 2.0.42, 2.0.40, 2.0.39, 2.0.37, 2.0.36, 2.0.35<p />
+</dd>
+<dd>
<b>moderate: </b>
<b>
<name name="CVE-2007-6388">mod_status XSS</name>
Modified: httpd/site/trunk/docs/security/vulnerabilities_22.html
URL: http://svn.apache.org/viewvc/httpd/site/trunk/docs/security/vulnerabilities_22.html?rev=612501&r1=612500&r2=612501&view=diff
==============================================================================
--- httpd/site/trunk/docs/security/vulnerabilities_22.html (original)
+++ httpd/site/trunk/docs/security/vulnerabilities_22.html Wed Jan 16 08:27:34 2008
@@ -96,6 +96,25 @@
<dd>
<b>low: </b>
<b>
+<name name="CVE-2008-0005">mod_proxy_ftp UTF-7 XSS</name>
+</b>
+<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0005">CVE-2008-0005</a>
+<p>
+A workaround was added in the mod_proxy_ftp module. On sites where
+mod_proxy_ftp is enabled and a forward proxy is configured, a
+cross-site scripting attack is possible against Web browsers which do
+not correctly derive the response character set following the rules in
+RFC 2616.
+</p>
+</dd>
+<dd />
+<dd>
+ Affects:
+ 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0<p />
+</dd>
+<dd>
+<b>low: </b>
+<b>
<name name="CVE-2007-6422">mod_proxy_balancer DoS</name>
</b>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6422">CVE-2007-6422</a>
Modified: httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml
URL: http://svn.apache.org/viewvc/httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml?rev=612501&r1=612500&r2=612501&view=diff
==============================================================================
--- httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml (original)
+++ httpd/site/trunk/xdocs/security/vulnerabilities-httpd.xml Wed Jan 16 08:27:34 2008
@@ -1,38 +1,4 @@
-<security updated="20080104">
-
-<issue fixed="2.2.8-dev" public="20080102" reported="20071212">
-<cve name="CVE-2007-6422"/>
-<severity level="4">low</severity>
-<title>mod_proxy_balancer DoS</title>
-<description><p>
-A flaw was found in the mod_proxy_balancer module. On sites where
-mod_proxy_balancer is enabled, an authorized user could send a carefully
-crafted request that would cause the Apache child process handling that
-request to crash. This could lead to a denial of service if using a
-threaded Multi-Processing Module. </p></description>
-<affects prod="httpd" version="2.2.6"/>
-<affects prod="httpd" version="2.2.5"/>
-<affects prod="httpd" version="2.2.4"/>
-<affects prod="httpd" version="2.2.3"/>
-<affects prod="httpd" version="2.2.2"/>
-<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.2.8-dev" public="20080102" reported="20071212">
-<cve name="CVE-2007-6421"/>
-<severity level="4">low</severity>
-<title>mod_proxy_balancer XSS</title>
-<description><p>
-A flaw was found in the mod_proxy_balancer module. On sites where
-mod_proxy_balancer is enabled, a cross-site scripting attack against an
-authorized user is possible. </p></description>
-<affects prod="httpd" version="2.2.6"/>
-<affects prod="httpd" version="2.2.5"/>
-<affects prod="httpd" version="2.2.4"/>
-<affects prod="httpd" version="2.2.3"/>
-<affects prod="httpd" version="2.2.2"/>
-<affects prod="httpd" version="2.2.0"/>
-</issue>
+<security updated="20080116">
<issue fixed="2.2.8-dev" public="20080102" reported="20071215">
<cve name="CVE-2007-6388"/>
@@ -203,6 +169,94 @@
<affects prod="httpd" version="1.3.2"/>
<affects prod="httpd" version="1.3.1"/>
<affects prod="httpd" version="1.3.0"/>
+</issue>
+
+<issue fixed="2.0.63-dev" public="20080108" reported="20071215">
+<cve name="CVE-2008-0005"/>
+<severity level="4">low</severity>
+<title>mod_proxy_ftp UTF-7 XSS</title>
+<description><p>
+A workaround was added in the mod_proxy_ftp module. On sites where
+mod_proxy_ftp is enabled and a forward proxy is configured, a
+cross-site scripting attack is possible against Web browsers which do
+not correctly derive the response character set following the rules in
+RFC 2616.
+</p></description>
+<affects prod="httpd" version="2.0.61"/>
+<affects prod="httpd" version="2.0.59"/>
+<affects prod="httpd" version="2.0.58"/>
+<affects prod="httpd" version="2.0.55"/>
+<affects prod="httpd" version="2.0.54"/>
+<affects prod="httpd" version="2.0.53"/>
+<affects prod="httpd" version="2.0.52"/>
+<affects prod="httpd" version="2.0.51"/>
+<affects prod="httpd" version="2.0.50"/>
+<affects prod="httpd" version="2.0.49"/>
+<affects prod="httpd" version="2.0.48"/>
+<affects prod="httpd" version="2.0.47"/>
+<affects prod="httpd" version="2.0.46"/>
+<affects prod="httpd" version="2.0.45"/>
+<affects prod="httpd" version="2.0.44"/>
+<affects prod="httpd" version="2.0.43"/>
+<affects prod="httpd" version="2.0.42"/>
+<affects prod="httpd" version="2.0.40"/>
+<affects prod="httpd" version="2.0.39"/>
+<affects prod="httpd" version="2.0.37"/>
+<affects prod="httpd" version="2.0.36"/>
+<affects prod="httpd" version="2.0.35"/>
+</issue>
+
+<issue fixed="2.2.8-dev" public="20080108" reported="20071215">
+<cve name="CVE-2008-0005"/>
+<severity level="4">low</severity>
+<title>mod_proxy_ftp UTF-7 XSS</title>
+<description><p>
+A workaround was added in the mod_proxy_ftp module. On sites where
+mod_proxy_ftp is enabled and a forward proxy is configured, a
+cross-site scripting attack is possible against Web browsers which do
+not correctly derive the response character set following the rules in
+RFC 2616.
+</p></description>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
+<issue fixed="2.2.8-dev" public="20080102" reported="20071212">
+<cve name="CVE-2007-6422"/>
+<severity level="4">low</severity>
+<title>mod_proxy_balancer DoS</title>
+<description><p>
+A flaw was found in the mod_proxy_balancer module. On sites where
+mod_proxy_balancer is enabled, an authorized user could send a carefully
+crafted request that would cause the Apache child process handling that
+request to crash. This could lead to a denial of service if using a
+threaded Multi-Processing Module. </p></description>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
+
+<issue fixed="2.2.8-dev" public="20080102" reported="20071212">
+<cve name="CVE-2007-6421"/>
+<severity level="4">low</severity>
+<title>mod_proxy_balancer XSS</title>
+<description><p>
+A flaw was found in the mod_proxy_balancer module. On sites where
+mod_proxy_balancer is enabled, a cross-site scripting attack against an
+authorized user is possible. </p></description>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
</issue>
<issue fixed="2.2.6" public="20061210" reported="20061210" released="20070907">