In May 2006 a reporter found a bug in Apache where an invalid Expect header sent to the server (Apache 1.3.3 onwards) would be returned to the user in an error message, unescaped. This could allow a cross-site scripting attack only if a victim can tricked into connecting to a site and sending such a carefully crafted Expect header. Whist browsers do not provide this functionality, it was recently discovered that Flash allows you to make a connection with arbitrary headers. The attack mechanism is therefore: 1. User is tricked into visiting a malicious web site with a flash-enabled browser 2. Malicious web site uses a flash movie to make a connection to the target site with custom Expect header 3. This results in cross-site scripting (attacker could steal your cookies from the third party site, or inject content etc) Note that this also affects RHEL2.1, and RHEL3. On RHEL3 and RHEL4 the cross-site scripting does not happen immediately, step 3 is delayed until the Apache server times out. On a default installation this could be 2-5 minutes. Therefore the attack is less likely to succeed. Patch: http://svn.apache.org/viewcvs?rev=394965&view=rev [1.3] http://svn.apache.org/viewcvs?rev=395172&view=rev [2.0]
Fixed in errata: http://rhn.redhat.com/errata/RHSA-2006-0619.html
This issue has been addressed in following products: Red Hat Certificate System 7.3 Via RHSA-2010:0602 https://rhn.redhat.com/errata/RHSA-2010-0602.html
This was fixed previously in these Red Hat products: Red Hat Certificate System 7.3 for 4AS: RHSA-2010:0602 Red Hat Enterprise Linux version 2.1: RHSA-2006:0618 Red Hat Enterprise Linux version 3: RHSA-2006:0619 Red Hat Enterprise Linux version 4: RHSA-2006:0619 Red Hat Network Proxy v 4.2 (RHEL v.3 AS): RHSA-2008:0523 Red Hat Network Proxy v 4.2 (RHEL v.4 AS): RHSA-2008:0523 Stronghold 4 for Red Hat Enterprise Linux: RHSA-2006:0692