Bug 494402 - (CVE-2009-0796) CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
source=redhat,public=20090401,reporte...
: Security
Depends On: 544455
Blocks:
  Show dependency treegraph
 
Reported: 2009-04-06 14:06 EDT by Josh Bressers
Modified: 2016-03-04 07:46 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2011-08-15 15:12:09 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Josh Bressers 2009-04-06 14:06:00 EDT
A flaw was found in the httpd mod_perl Apache::Status module. If a site has the non default setting of making /perl-status page accessible, remote attackers could use that flaw to trick users or steal sensitive browser data.

The original public announcement can be found here:
http://marc.info/?l=apache-modperl&m=123862312808765&w=2

The CVE id mentioned in the above mail is wrong, CVE-2009-0796 is the proper CVE id.
Comment 3 Jan Lieskovsky 2009-06-10 14:08:51 EDT
The Red Hat Security Response Team has rated this issue as having moderate security impact, a future mod_perl package update may address this
flaw. More information regarding issue severity can be found here:
http://www.redhat.com/security/updates/classification/

Explanation:
------------
The vulnerability affects non default configuration of Apache HTTP web
server, i.e cases, when access to Apache::Status and Apache2::Status
resources is explicitly allowed via <Location /perl-status> httpd.conf  configuration directive.
   Its occurrence can be prevented by using the default configuration
for the Apache HTTP web server (not exporting /perl-status).
Comment 4 Vincent Danen 2009-12-04 17:34:20 EST
This also affects all current Fedora releases (10, 11, 12, and rawhide).
Comment 6 Joe Orton 2009-12-08 12:02:51 EST
Upstream trunk commit:

http://svn.apache.org/viewvc/perl/modperl/trunk/lib/Apache2/Status.pm?r1=607697&
r2=760926
Comment 8 Vincent Danen 2011-06-17 15:32:32 EDT
This was fixed in Fedora a while ago:

* Tue Dec 08 2009 Joe Orton <jorton@redhat.com> - 2.0.4-10
- add security fix for CVE-2009-0796 (#544455)
Comment 9 Josh Bressers 2011-08-15 15:12:09 EDT
I'm closing this as wontfix. It's fixed in newer versions of mod_perl, the actual threat here is very minimal.

Note You need to log in before you can comment on or make changes to this bug.