Bug 494402 (CVE-2009-0796)

Summary:	CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jlieskov, jorton, mjc, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-08-15 19:12:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	544455
Bug Blocks:

Description Josh Bressers 2009-04-06 18:06:00 UTC

A flaw was found in the httpd mod_perl Apache::Status module. If a site has the non default setting of making /perl-status page accessible, remote attackers could use that flaw to trick users or steal sensitive browser data.

The original public announcement can be found here:
http://marc.info/?l=apache-modperl&m=123862312808765&w=2

The CVE id mentioned in the above mail is wrong, CVE-2009-0796 is the proper CVE id.

Comment 2 Jan Lieskovsky 2009-06-10 17:45:32 UTC

Upstream patch:

http://svn.apache.org/viewvc/perl/modperl/branches/1.x/lib/Apache/Status.pm?view=log&pathrev=761081

Comment 3 Jan Lieskovsky 2009-06-10 18:08:51 UTC

The Red Hat Security Response Team has rated this issue as having moderate security impact, a future mod_perl package update may address this
flaw. More information regarding issue severity can be found here:
http://www.redhat.com/security/updates/classification/

Explanation:
------------
The vulnerability affects non default configuration of Apache HTTP web
server, i.e cases, when access to Apache::Status and Apache2::Status
resources is explicitly allowed via <Location /perl-status> httpd.conf  configuration directive.
   Its occurrence can be prevented by using the default configuration
for the Apache HTTP web server (not exporting /perl-status).

Comment 4 Vincent Danen 2009-12-04 22:34:20 UTC

This also affects all current Fedora releases (10, 11, 12, and rawhide).

Comment 6 Joe Orton 2009-12-08 17:02:51 UTC

Upstream trunk commit:

http://svn.apache.org/viewvc/perl/modperl/trunk/lib/Apache2/Status.pm?r1=607697&
r2=760926

Comment 8 Vincent Danen 2011-06-17 19:32:32 UTC

This was fixed in Fedora a while ago:

* Tue Dec 08 2009 Joe Orton <jorton> - 2.0.4-10
- add security fix for CVE-2009-0796 (#544455)

Comment 9 Josh Bressers 2011-08-15 19:12:09 UTC

I'm closing this as wontfix. It's fixed in newer versions of mod_perl, the actual threat here is very minimal.