httpd: cross-site scripting, denial of service [LWN.net]

Package(s):

httpd

CVE #(s):

CVE-2007-6421 CVE-2007-6422

Created:

January 15, 2008

Updated:

April 4, 2008

Description:

A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer was enabled, a cross-site scripting attack against an authorized user was possible. (CVE-2007-6421)

A flaw was found in the mod_proxy_balancer module. On sites where mod_proxy_balancer was enabled, an authorized user could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-6422)

Alerts:

SuSE	SUSE-SA:2008:021	2008-04-04
Gentoo	200803-19	2008-03-11
Fedora	FEDORA-2008-1695	2008-02-15
Fedora	FEDORA-2008-1711	2008-02-15
Slackware	SSA:2008-045-01	2008-02-15
Ubuntu	USN-575-1	2008-02-04
Red Hat	RHSA-2008:0009-01	2008-01-21
Red Hat	RHSA-2008:0008-01	2008-01-15

(Log in to post comments)

httpd: cross-site scripting, denial of service

Posted Jan 22, 2008 21:24 UTC (Tue) by kreutzm (subscriber, #4700) [Link]

Debian Sarge is not vulnerable.