Two security vulnerabilities have been found in the Apache HTTP server that affect the Apache 2.0 web server bundled with Solaris 10:

1. A  Denial of Service (DoS) vulnerability in the "mod_proxy_http" Apache server module (CVE-2008-2364), may allow a remote unprivileged user who is in control of a web server to which requests may be proxied, to cause a denial of service to the Apache
"httpd" process (or potentially to the system as a whole as the application may consume excessive resources).

2. A  Cross Site Scripting (CSS or XSS) vulnerability in the "mod_proxy_ftp" Apache server module (CVE-2008-2939), may allow a remote unprivileged user to inject arbitrary web script or HTML. This may allow the unprivileged user to bypass access control and gain access
to unauthorized data.

These issues are described in the following documents:

CVE-2008-2364 at:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2364

CVE-2008-2939 at:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2939
  

Permalink |