Bug 427228 (CVE-2007-6388)

Summary:	CVE-2007-6388 apache mod_status cross-site scripting
Product:	[Other] Security Response	Reporter:	Mark J. Cox <mjc>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jlieskov, jorton, kreilly
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6388
Whiteboard:
Fixed In Version:	2.2.8-1.fc7, httpd 1.3.41,	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-02-16 02:08:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	427234, 427235, 427236, 427237, 427238, 427239, 427240, 427241, 427242, 427243, 427244, 427982, 427983, 427984, 430775, 430776, 430777, 430780, 430781, 430782, 449336, 449337
Bug Blocks:	444136

Description Mark J. Cox 2008-01-02 12:49:54 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-6388 to the following vulnerability:

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem.  When the candidate has been publicized, the details for this candidate will be provided.

References:

Comment 1 Mark J. Cox 2008-01-02 12:51:16 UTC

according to http://marc.info/?l=apache-cvs&m=119892119829161&w=2

 *) SECURITY: CVE-2007-6388 (cve.mitre.org)
    mod_status: Ensure refresh parameter is numeric to prevent
    a possible XSS attack caused by redirecting to other URLs.
    Reported by SecurityReason.  [Mark Cox, Joe Orton]

Comment 2 Mark J. Cox 2008-01-02 12:53:27 UTC

This issue is moderate severity as the status page is not enabled by default,
and the suggested configuration protects the status page by hostname (therefore
limiting the scope of the XSS to sites that have made their status page public
or only against site administrators).

Comment 13 Fedora Update System 2008-02-13 14:28:39 UTC

httpd-2.2.8-1.fc8 has been submitted as an update for Fedora 8

Comment 14 Fedora Update System 2008-02-13 14:32:49 UTC

httpd-2.2.8-1.fc7 has been submitted as an update for Fedora 7

Comment 15 Fedora Update System 2008-02-16 02:08:05 UTC

httpd-2.2.8-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2008-02-16 02:10:46 UTC

httpd-2.2.8-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 errata-xmlrpc 2010-08-04 21:32:57 UTC

This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html