Bug 733043 (CVE-2003-1418)

Summary:	CVE-2003-1418 httpd information disclosure in FileEtag
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jorton, prc
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-08-24 15:03:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2011-08-24 15:00:50 UTC

Apache HTTP Server allows remote attackers to obtain information via (1)
the ETag header, which reveals the inode number, or (2) multipart MIME
boundary, which reveals child proccess IDs (PID).

Comment 1 Josh Bressers 2011-08-24 15:03:39 UTC

Statement:

Red Hat does not consider this to be a security issue. The information returned poses no threat to the target machine running httpd.

Comment 2 Tomas Hoger 2011-09-05 11:06:42 UTC

Recent upstream discussion and upstream bug report:
http://thread.gmane.org/gmane.comp.apache.devel/45495
https://issues.apache.org/bugzilla/show_bug.cgi?id=49623

As pointed out there, content of the ETag header can be controlled using the FileETag directive.  Its default value is: INode MTime Size

Changing to MTime Size will cause httpd to not use file INode in the ETag headers.

http://httpd.apache.org/docs/2.2/mod/core.html#fileetag