Bug 289511 – CVE-2007-4465 mod_autoindex XSS

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 289511 - (CVE-2007-4465) CVE-2007-4465 mod_autoindex XSS

Summary:	CVE-2007-4465 mod_autoindex XSS

Status:	CLOSED ERRATA

Aliases:	CVE-2007-4465

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	source=bugtraq,reported=20070913,publ...
Keywords:	Security

Depends On:	413891 449336 294441 294451 411711 414281 421591 421601 421611 421621 421631 421641 436792 436793 436794 436795 436796 436797 449337 582767
Blocks:	444136
	Show dependency tree / graph

Reported:	2007-09-13 13:31 EDT by Josh Bressers
Modified:	2016-03-04 05:46 EST (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-08-21 18:44:48 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2007:0911	normal	SHIPPED_LIVE	Moderate: httpd security update	2007-10-25 13:35:49 EDT
Red Hat Product Errata	RHSA-2008:0004	normal	SHIPPED_LIVE	Moderate: apache security update	2008-01-15 04:09:50 EST
Red Hat Product Errata	RHSA-2008:0005	normal	SHIPPED_LIVE	Moderate: httpd security update	2008-01-15 04:17:20 EST
Red Hat Product Errata	RHSA-2008:0006	normal	SHIPPED_LIVE	Moderate: httpd security update	2008-01-15 04:25:40 EST
Red Hat Product Errata	RHSA-2008:0008	normal	SHIPPED_LIVE	Moderate: httpd security update	2008-01-15 04:38:32 EST
Red Hat Product Errata	RHSA-2010:0602	normal	SHIPPED_LIVE	Moderate: Red Hat Certificate System 7.3 security update	2010-08-05 10:04:51 EDT

Groups: None (edit)

Description Josh Bressers 2007-09-13 13:31:15 EDT

mod_autoindex in httpd contains a cross site scripting flaw via the P query option.

More information can be found in the original vulnerability report here:
http://www.securityfocus.com/archive/1/479237/30/0/threaded

Comment 1 Josh Bressers 2007-09-13 13:39:27 EDT

Joe,

Can you comment on this, should this flaw be rated as having low severity?

Comment 2 Josh Bressers 2007-09-13 14:16:51 EDT

Joe says this should be low, so low it is.

Comment 3 Mark J. Cox 2007-09-14 08:42:17 EDT

According to NVD:

Official Statement from Apache (9/14/2007)
The Apache security team believe that this issue is due to web browsers that are
violating RFC2616.

However, Apache 2.2.6 and 2.0.61 add a workaround for such browsers by adding
Type and Charset options to IndexOptions directive. This allows a site
administrator to explicitly set the content-type and charset of the generated
directory index page.

Comment 9 Mark J. Cox 2007-12-12 09:59:10 EST

A flaw was found in the mod_autoindex module.  On sites where directory
listings are used, and the AddDefaultCharset directive has been removed
from the configuration, a cross-site-scripting attack may be possible
against browsers which do not correctly derive the response character set
following the rules in RFC 2616. (CVE-2007-4465)

Comment 11 errata-xmlrpc 2010-08-04 17:32:38 EDT

This issue has been addressed in following products:

  Red Hat Certificate System 7.3

Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html

Note You need to log in before you can comment on or make changes to this bug.