Bug 289511 (CVE-2007-4465)

Summary: CVE-2007-4465 mod_autoindex XSS
Product: [Other] Security Response Reporter: Josh Bressers <bressers>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jorton, kreilly
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: source=bugtraq,reported=20070913,public=20070913,impact=low,cwe=CWE-79[auto]
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-21 22:44:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 413891, 449336, 294441, 294451, 411711, 414281, 421591, 421601, 421611, 421621, 421631, 421641, 436792, 436793, 436794, 436795, 436796, 436797, 449337, 582767    
Bug Blocks: 444136    

Description Josh Bressers 2007-09-13 17:31:15 UTC
mod_autoindex in httpd contains a cross site scripting flaw via the P query option.

More information can be found in the original vulnerability report here:

Comment 1 Josh Bressers 2007-09-13 17:39:27 UTC

Can you comment on this, should this flaw be rated as having low severity?

Comment 2 Josh Bressers 2007-09-13 18:16:51 UTC
Joe says this should be low, so low it is.

Comment 3 Mark J. Cox 2007-09-14 12:42:17 UTC
According to NVD:

Official Statement from Apache (9/14/2007)
The Apache security team believe that this issue is due to web browsers that are
violating RFC2616.

However, Apache 2.2.6 and 2.0.61 add a workaround for such browsers by adding
Type and Charset options to IndexOptions directive. This allows a site
administrator to explicitly set the content-type and charset of the generated
directory index page.

Comment 9 Mark J. Cox 2007-12-12 14:59:10 UTC
A flaw was found in the mod_autoindex module.  On sites where directory
listings are used, and the AddDefaultCharset directive has been removed
from the configuration, a cross-site-scripting attack may be possible
against browsers which do not correctly derive the response character set
following the rules in RFC 2616. (CVE-2007-4465)

Comment 11 errata-xmlrpc 2010-08-04 21:32:38 UTC
This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html