Advisories MDKSA-2007:142: Updated apache packages fix multiple security issues

[paul]

A vulnerability was discovered in the the Apache mod_status module

that could lead to a cross-site scripting attack on sites where the

server-status page was publically accessible and ExtendedStatus was

enabled (CVE-2006-5752).

 

The Apache server also did not verify that a process was an Apache

child process before sending it signals. A local attacker with the

ability to run scripts on the server could manipulate the scoreboard

and cause arbitrary processes to be terminated (CVE-2007-3304).

 

Updated packages have been patched to prevent the above issues.