Apache HTTP Server allows remote attackers to obtain information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child proccess IDs (PID).
Statement: Red Hat does not consider this to be a security issue. The information returned poses no threat to the target machine running httpd.
Recent upstream discussion and upstream bug report: http://thread.gmane.org/gmane.comp.apache.devel/45495 https://issues.apache.org/bugzilla/show_bug.cgi?id=49623 As pointed out there, content of the ETag header can be controlled using the FileETag directive. Its default value is: INode MTime Size Changing to MTime Size will cause httpd to not use file INode in the ETag headers. http://httpd.apache.org/docs/2.2/mod/core.html#fileetag