PT-2002-2150 · Apache · Apache Mod Ssl

Published 2002-11-04 · Updated 2008-09-05 · CVE-2002-1157

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apache mod ssl module version 2.8.9 and earlier

Description: A cross-site scripting issue exists in the mod ssl Apache module. This occurs when UseCanonicalName is off and wildcard DNS is enabled, allowing remote attackers to execute scripts as other web site visitors. The attack vector involves the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL.

Recommendations: For Apache mod ssl module version 2.8.9 and earlier, consider updating to a version where this issue is resolved, or as a temporary workaround, enable UseCanonicalName and disable wildcard DNS to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1157

DSA-181

Affected Products

Apache Mod Ssl

References · 16

• http://redhat.com/support/errata/RHSA-2002-222.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-243.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-248.html · Vendor Advisory
• http://iss.net/security_center/static/10457.php · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000541 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-106.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-251.html · Vendor Advisory
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-072.php · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-244.html · Vendor Advisory
• http://linuxsecurity.com/advisories/other_advisory-2512.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1157 · Security Note
• http://debian.org/security/2002/dsa-181 · Vendor Advisory
• http://osvdb.org/2107 · Note
• http://online.securityfocus.com/archive/1/296753 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-10/0374.html · Note