Apache HTTP Server 存在模块跨站脚本漏洞

受影响系统： apache group apache 2.2.x apache group apache 2.0.x apache group apache 1.3.x 不受影响系统： apache group apache 2.2.6 apache group apache 2.0.61 apache group apache 1.3.39 描述： -------------------------------------------------------------------------------- bugtraq id: 24645 cve(can) id: cve-2006-5752 apache http server是一款流行的web服务器。 apache http server（httpd）的mod_status模块中的mod_status.c文件存在跨站脚本漏洞，远程攻击者可能利用此漏洞在用户的浏览器中执行恶意代码。 如果站点的server-status页面公开可访问且启用了extendedstatus的话，远程攻击者就可以在执行字符集检查的浏览器中通过没有指定content-type的页面注入并执行脚本或html代码。 <*来源：stefan esser （[e-mail]） 链接：http://secunia.com/advisories/26273 http://httpd.apache.org/security/vulnerabilities_22.html http://httpd.apache.org/security/vulnerabilities_20.html http://svn.apache.org/viewvc?view=rev&revision=549159 https://bugzilla.redhat.com/long_list.cgi?buglist=245112 http://httpd.apache.org/security/vulnerabilities_13.html https://www.redhat.com/support/errata/rhsa-2007-0533.html https://www.redhat.com/support/errata/rhsa-2007-0557.html https://www.redhat.com/support/errata/rhsa-2007-0556.html https://www.redhat.com/support/errata/rhsa-2007-0534.html https://www.redhat.com/support/errata/rhsa-2007-0532.html *> 建议： -------------------------------------------------------------------------------- 厂商补丁： apache group ------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://httpd.apache.org/download.cgi redhat ------ redhat已经为此发布了安全公告（rhsa-2007:0533-01、rhsa-2007:0556-01、rhsa-2007:0532-01、rhsa-2007:0557-01、rhsa-2007:0534-01）以及相应补丁: rhsa-2007:0533-01：moderate: httpd security update 链接：https://www.redhat.com/support/errata/rhsa-2007-0533.html rhsa-2007:0556-01：moderate: httpd security update 链接：https://www.redhat.com/support/errata/rhsa-2007-0556.html rhsa-2007:0532-01：moderate: apache security update 链接：https://www.redhat.com/support/errata/rhsa-2007-0532.html rhsa-2007:0557-01：moderate: httpd security update 链接：https://www.redhat.com/support/errata/rhsa-2007-0557.html rhsa-2007:0534-01：moderate: httpd security update 链接：https://www.redhat.com/support/errata/rhsa-2007-0534.html