Bug 289511 (CVE-2007-4465)

Summary:	CVE-2007-4465 mod_autoindex XSS
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jorton, kreilly
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-21 22:44:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	294441, 294451, 411711, 413891, 414281, 421591, 421601, 421611, 421621, 421631, 421641, 436792, 436793, 436794, 436795, 436796, 436797, 449336, 449337, 582767
Bug Blocks:	444136

Description Josh Bressers 2007-09-13 17:31:15 UTC

mod_autoindex in httpd contains a cross site scripting flaw via the P query option.

More information can be found in the original vulnerability report here:
http://www.securityfocus.com/archive/1/479237/30/0/threaded

Comment 1 Josh Bressers 2007-09-13 17:39:27 UTC

Joe,

Can you comment on this, should this flaw be rated as having low severity?

Comment 2 Josh Bressers 2007-09-13 18:16:51 UTC

Joe says this should be low, so low it is.

Comment 3 Mark J. Cox 2007-09-14 12:42:17 UTC

According to NVD:

Official Statement from Apache (9/14/2007)
The Apache security team believe that this issue is due to web browsers that are
violating RFC2616.

However, Apache 2.2.6 and 2.0.61 add a workaround for such browsers by adding
Type and Charset options to IndexOptions directive. This allows a site
administrator to explicitly set the content-type and charset of the generated
directory index page.

Comment 9 Mark J. Cox 2007-12-12 14:59:10 UTC

A flaw was found in the mod_autoindex module.  On sites where directory
listings are used, and the AddDefaultCharset directive has been removed
from the configuration, a cross-site-scripting attack may be possible
against browsers which do not correctly derive the response character set
following the rules in RFC 2616. (CVE-2007-4465)

Comment 11 errata-xmlrpc 2010-08-04 21:32:38 UTC

This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html