Bug 157536

Summary:	Apache APR incorrectly requires R_OK for chdir(2)
Product:	Red Hat Enterprise Linux 4	Reporter:	Brian DeFeyter <bdf>
Component:	apr	Assignee:	Joe Orton <jorton>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://issues.apache.org/bugzilla/show_bug.cgi?id=30137
Whiteboard:
Fixed In Version:	RHBA-2005-622	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-10-05 15:37:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	156322

Description Brian DeFeyter 2005-05-12 14:19:41 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

Description of problem:
The current stable httpd package in RHEL4 contains a bug in APR which requires R_OK to be present on a directory in order to read it's contents when really only X_OK is necessary.

This bug was fixed in the Apache 2.0.53 release

More information is available here: http://issues.apache.org/bugzilla/show_bug.cgi?id=30137

This is somewhat of a security issue, as it requires more permissions to be set than necessary to allow httpd access to web content.

Version-Release number of selected component (if applicable):
httpd-2.0.52-9.ent

How reproducible:
Always

Steps to Reproduce:
N/A  

Additional info:

Comment 1 Joe Orton 2005-05-12 14:22:30 UTC

Thanks for the report.

Comment 6 Brian DeFeyter 2005-07-25 20:29:23 UTC

Hello,

I'm just wondering if there's going to be a patch released for this at some
point in the near future?

Thanks,
Brian

Comment 7 Joe Orton 2005-07-25 20:40:27 UTC

Brian, the fix is currently scheduled for inclusion in U2 - experimental test
packages are available here: http://people.redhat.com/jorton/Nahant-apr/

Comment 8 Red Hat Bugzilla 2005-10-05 15:37:45 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2005-622.html