RHSA-2009:1155: Important: httpd security update
The Apache HTTP Server is a popular Web server.A denial of service flaw was found in the Apache modproxy module when itwas used as a reverse proxy. A remote attacker could use this flaw to forcea proxy process to consume large amounts of CPU time. (CVE-2009-1890)A flaw was found in the handling of the "Options" and "AllowOverride"directives used by the Apache HTTP Server. In configurations using the"AllowOverride" directive with certain "Options=" arguments, local userswere not restricted from executing commands from a Server-Side-Includescript as intended. (CVE-2009-1195)A denial of service flaw was found in the Apache moddeflate module. Thismodule continued to compress large files until compression was complete,even if the network connection that requested the content was closed beforecompression completed. This would cause moddeflate to consume largeamounts of CPU if moddeflate was enabled for a large file. (CVE-2009-1891)All users of JBoss Enterprise Web Server 1.0.0 should upgrade to theseupdated packages, which contain backported patches to correct these issues.After installing the updated packages, the httpd daemon must be restartedfor the update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:1155?
The vulnerability RHSA-2009:1155 is classified as a denial of service flaw in the Apache HTTP Server.
How do I fix RHSA-2009:1155?
To fix RHSA-2009:1155, update to the package version 2.2.10-10.ep5.el5 for the Apache HTTP Server.
What systems are affected by RHSA-2009:1155?
RHSA-2009:1155 affects certain versions of the Apache HTTP Server 2.2.10 on Red Hat Enterprise Linux 5.
What are the potential impacts of RHSA-2009:1155?
If exploited, RHSA-2009:1155 could result in excessive CPU consumption, leading to denial of service.
Who is responsible for reporting RHSA-2009:1155?
The advisory RHSA-2009:1155 was issued by Red Hat in response to reported vulnerabilities in its software.