rhsa-2001_164
Vulnerability from csaf_redhat
Published
2002-07-01 10:35
Modified
2024-11-21 22:11
Summary
Red Hat Security Advisory: : Updated secureweb packages available

Notes

Topic
Updated packages are now available for Red Hat Secure Web Server 3.2 (U.S.). These updates close a potential security hole which would present clients with a listing of the contents of a directory instead of the contents of an index file or the proper error message. The previous revision of this errata advisory included incorrect URLs. This revision lists the correct location of the updated packages.
Details
By using a carefully constructed HTTP request, a server with mod_negotiation and either mod_dir or mod_autoindex loaded could be tricked into displaying a listing of the contents of a directory, despite the presence of an index file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2001-0730, and CAN-2001-0731 to these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated packages are now available for Red Hat Secure Web Server 3.2 (U.S.). \nThese updates close a potential security hole which would present clients\nwith a listing of the contents of a directory instead of the contents of an\nindex file or the proper error message.\n\nThe previous revision of this errata advisory included incorrect URLs. This\nrevision lists the correct location of the updated packages.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "By using a carefully constructed HTTP request, a server with\nmod_negotiation and either mod_dir or mod_autoindex loaded could be tricked\ninto displaying a listing of the contents of a directory, despite the\npresence of an index file.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the names CAN-2001-0730, and CAN-2001-0731 to these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2001:164",
        "url": "https://access.redhat.com/errata/RHSA-2001:164"
      },
      {
        "category": "external",
        "summary": "http://www.apacheweek.com/issues/01-10-05#security",
        "url": "http://www.apacheweek.com/issues/01-10-05#security"
      },
      {
        "category": "external",
        "summary": "http://httpd.apache.org/dist/httpd/CHANGES_1.3",
        "url": "http://httpd.apache.org/dist/httpd/CHANGES_1.3"
      },
      {
        "category": "external",
        "summary": "http://www.securityfocus.com/bid/3009",
        "url": "http://www.securityfocus.com/bid/3009"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2001_164.json"
      }
    ],
    "title": "Red Hat Security Advisory: : Updated secureweb packages available",
    "tracking": {
      "current_release_date": "2024-11-21T22:11:29+00:00",
      "generator": {
        "date": "2024-11-21T22:11:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2001:164",
      "initial_release_date": "2002-07-01T10:35:00+00:00",
      "revision_history": [
        {
          "date": "2002-07-01T10:35:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2001-12-05T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:11:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Secure Web Server 3.2",
                "product": {
                  "name": "Red Hat Secure Web Server 3.2",
                  "product_id": "Red Hat Secure Web Server 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:secure_web_server:3.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Secure Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2001-0730",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616611"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "split-logfile in Apache 1.3.20 allows remote attackers to overwrite arbitrary files that end in the .log extension via an HTTP request with a / (slash) in the Host: header.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Secure Web Server 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2001-0730"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616611",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616611"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2001-0730",
          "url": "https://www.cve.org/CVERecord?id=CVE-2001-0730"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-0730",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2001-0730"
        }
      ],
      "release_date": "2001-09-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-07-01T10:35:00+00:00",
          "details": "The main secureweb package is provided as an rhmask file.  In order to\ngenerate the actual secureweb RPM package, you will need the\nsecureweb-3.2-12 package file from the Secure Web Server CD.  Then, using\nthe rhmask command, generate the secureweb RPM package:\n\nrhmask secureweb-3.2-12.i386.rpm secureweb-3.2.4-1.i386.rpm.rhmask\n\nBefore applying this update, make sure you have applied all previously\nreleased errata relevant to your system.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.",
          "product_ids": [
            "Red Hat Secure Web Server 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2001:164"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2001-0731",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616612"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Apache 1.3.20 with Multiviews enabled allows remote attackers to view directory contents and bypass the index page via a URL containing the \"M=D\" query string.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Secure Web Server 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2001-0731"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616612",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616612"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2001-0731",
          "url": "https://www.cve.org/CVERecord?id=CVE-2001-0731"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-0731",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2001-0731"
        }
      ],
      "release_date": "2001-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2002-07-01T10:35:00+00:00",
          "details": "The main secureweb package is provided as an rhmask file.  In order to\ngenerate the actual secureweb RPM package, you will need the\nsecureweb-3.2-12 package file from the Secure Web Server CD.  Then, using\nthe rhmask command, generate the secureweb RPM package:\n\nrhmask secureweb-3.2-12.i386.rpm secureweb-3.2.4-1.i386.rpm.rhmask\n\nBefore applying this update, make sure you have applied all previously\nreleased errata relevant to your system.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.",
          "product_ids": [
            "Red Hat Secure Web Server 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2001:164"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.