Bug 494402 (CVE-2009-0796) - CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
Summary: CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2009-0796
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 544455
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-04-06 18:06 UTC by Josh Bressers
Modified: 2019-09-29 12:29 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-08-15 19:12:09 UTC


Attachments (Terms of Use)

Description Josh Bressers 2009-04-06 18:06:00 UTC
A flaw was found in the httpd mod_perl Apache::Status module. If a site has the non default setting of making /perl-status page accessible, remote attackers could use that flaw to trick users or steal sensitive browser data.

The original public announcement can be found here:
http://marc.info/?l=apache-modperl&m=123862312808765&w=2

The CVE id mentioned in the above mail is wrong, CVE-2009-0796 is the proper CVE id.

Comment 3 Jan Lieskovsky 2009-06-10 18:08:51 UTC
The Red Hat Security Response Team has rated this issue as having moderate security impact, a future mod_perl package update may address this
flaw. More information regarding issue severity can be found here:
http://www.redhat.com/security/updates/classification/

Explanation:
------------
The vulnerability affects non default configuration of Apache HTTP web
server, i.e cases, when access to Apache::Status and Apache2::Status
resources is explicitly allowed via <Location /perl-status> httpd.conf  configuration directive.
   Its occurrence can be prevented by using the default configuration
for the Apache HTTP web server (not exporting /perl-status).

Comment 4 Vincent Danen 2009-12-04 22:34:20 UTC
This also affects all current Fedora releases (10, 11, 12, and rawhide).

Comment 6 Joe Orton 2009-12-08 17:02:51 UTC
Upstream trunk commit:

http://svn.apache.org/viewvc/perl/modperl/trunk/lib/Apache2/Status.pm?r1=607697&
r2=760926

Comment 8 Vincent Danen 2011-06-17 19:32:32 UTC
This was fixed in Fedora a while ago:

* Tue Dec 08 2009 Joe Orton <jorton@redhat.com> - 2.0.4-10
- add security fix for CVE-2009-0796 (#544455)

Comment 9 Josh Bressers 2011-08-15 19:12:09 UTC
I'm closing this as wontfix. It's fixed in newer versions of mod_perl, the actual threat here is very minimal.


Note You need to log in before you can comment on or make changes to this bug.