Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

Bugtraq ID:	15834
Class:	Input Validation Error
CVE:	CVE-2005-3352
Remote:	Yes
Local:	No
Published:	Dec 13 2005 12:00AM
Updated:	Jul 16 2013 10:43PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 Turbolinux Turbolinux Server 10.0 x86 Turbolinux Turbolinux Server 10.0 Turbolinux Turbolinux Desktop 10.0 Turbolinux Turbolinux FUJI Turbolinux Turbolinux 10 F... TurboLinux Personal TurboLinux Multimedia Turbolinux Home Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server RedHat Stronghold for Enterprise Linux 0 RedHat Network Proxy (for RHEL 3) 4.2 RedHat Linux 9.0 i386 RedHat Linux 7.3 i386 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat Advanced Workstation for the Itanium Processor 2.1 IA64 RedHat Advanced Workstation for the Itanium Processor 2.1 Red Hat Network Proxy (for RHEL 4) 4.2 Red Hat Fedora Core3 Red Hat Fedora Core2 Red Hat Fedora Core1 Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.4 OpenPKG OpenPKG 2.3 OpenPKG OpenPKG Current mod_ssl mod_ssl 2.8.24 + Apple Mac OS X 10.2.8 + Apple Mac OS X Server 10.3.6 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 IBM HTTP Server 2.0.47 .1 IBM HTTP Server 2.0.47 IBM HTTP Server 2.0.42 .2 IBM HTTP Server 2.0.42 .1 IBM HTTP Server 2.0.42 HP Webproxy A.02.10 + HP HP-UX B.11.04 HP VirtualVault 4.7 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 .132 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP OpenVMS Secure Web Server 1.2 HP OpenVMS Secure Web Server 1.1 -1 HP OpenVMS Secure Web Server 2.1-1 HP OpenView Network Node Manager 7.51 HP OpenView Network Node Manager 7.01 HP OpenView Network Node Manager 6.41 HP HP-UX B.11.23 HP HP-UX B.11.11 HP HP-UX B.11.04 HP HP-UX B.11.00 Gentoo Linux Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Conectiva Linux 10.0 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apache Software Foundation Apache 2.0.55 Apache Software Foundation Apache 2.0.54 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Apache Software Foundation Apache 2.0.53 Apache Software Foundation Apache 2.0.52 Apache Software Foundation Apache 2.0.51 Apache Software Foundation Apache 2.0.50 Apache Software Foundation Apache 2.0.49 Apache Software Foundation Apache 2.0.48 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + S.u.S.E. Linux 8.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Apache Software Foundation Apache 2.0.47 Apache Software Foundation Apache 2.0.46 Apache Software Foundation Apache 2.0.45 Apache Software Foundation Apache 2.0.44 Apache Software Foundation Apache 2.0.43 Apache Software Foundation Apache 2.0.42 Apache Software Foundation Apache 2.0.40 + RedHat Linux 9.0 i386 + RedHat Linux 8.0 + Terra Soft Solutions Yellow Dog Linux 3.0 Apache Software Foundation Apache 2.0.39 Apache Software Foundation Apache 2.0.37 Apache Software Foundation Apache 2.0.36 Apache Software Foundation Apache 2.0.35 Apache Software Foundation Apache 1.3.34 Apache Software Foundation Apache 1.3.33 Apache Software Foundation Apache 1.3.32 + Gentoo Linux 1.4 + Gentoo Linux Apache Software Foundation Apache 1.3.31 + OpenPKG OpenPKG Current Apache Software Foundation Apache 1.3.29 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.2.7 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.2.7 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + OpenPKG OpenPKG 2.0 Apache Software Foundation Apache 1.3.28 + Conectiva Linux 8.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + OpenBSD OpenBSD 3.4 + OpenPKG OpenPKG 1.3 Apache Software Foundation Apache 1.3.27 + HP HP-UX (VVOS) 11.0 4 + HP VirtualVault 4.6 + HP VirtualVault 4.5 + HP Webproxy 2.0 + Immunix Immunix OS 7+ + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + OpenBSD OpenBSD 3.3 + OpenPKG OpenPKG Current + Red Hat Enterprise Linux AS 2.1 IA64 + Red Hat Enterprise Linux AS 2.1 + RedHat Enterprise Linux ES 2.1 IA64 + RedHat Enterprise Linux ES 2.1 + RedHat Enterprise Linux WS 2.1 IA64 + RedHat Enterprise Linux WS 2.1 + RedHat Linux Advanced Work Station 2.1 + SGI IRIX 6.5.19 Apache Software Foundation Apache 1.3.26 + Conectiva Linux 8.0 + Conectiva Linux 7.0 + Conectiva Linux 6.0 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + OpenPKG OpenPKG 1.1 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 Apache Software Foundation Apache 1.3.24 Apache Software Foundation Apache 1.3.22 Apache Software Foundation Apache 1.3.20 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Apache Software Foundation Apache 1.3.19 Apache Software Foundation Apache 1.3.17 Apache Software Foundation Apache 1.3.14 + EnGarde Secure Linux 1.0.1 - MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + SGI IRIX 6.5.11 + SGI IRIX 6.5.10 + SGI IRIX 6.5.9 + SGI IRIX 6.5.8 + SGI IRIX 6.5.7 + SGI IRIX 6.5.6 + SGI IRIX 6.5.5 + SGI IRIX 6.5.4 + SGI IRIX 6.5.3 + SGI IRIX 6.5.2 + SGI IRIX 6.5.1 + SGI IRIX 6.5 Apache Software Foundation Apache 1.3.12 Apache Software Foundation Apache 1.3.11 Apache Software Foundation Apache 1.3.9 Apache Software Foundation Apache 1.3.6 Apache Software Foundation Apache 1.3.4 Apache Software Foundation Apache 1.3.3 + RedHat Linux 5.2 sparc + RedHat Linux 5.2 i386 + RedHat Linux 5.2 alpha Apache Software Foundation Apache 1.3.1 Apache Software Foundation Apache 1.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X 10.2.2 + Apple Mac OS X 10.2.1 + Apple Mac OS X 10.2 + Apple Mac OS X 10.1.5 + Apple Mac OS X 10.1.4 + Apple Mac OS X 10.1.3 + Apple Mac OS X 10.1.2 + Apple Mac OS X 10.1.1 + Apple Mac OS X 10.1 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3 + Apple Mac OS X Server 10.2.2 + Apple Mac OS X Server 10.2.1 + Apple Mac OS X Server 10.2 + Apple Mac OS X Server 10.1.5 + Apple Mac OS X Server 10.1.4 + Apple Mac OS X Server 10.1.3 + Apple Mac OS X Server 10.1.2 + Apple Mac OS X Server 10.1.1 + Apple Mac OS X Server 10.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0
Not Vulnerable:	HP OpenVMS Secure Web Server 2.2 Apache Software Foundation Apache 2.0.56 -dev Apache Software Foundation Apache 1.3.35 -dev

Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

Apache's 'mod_imap' module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

No exploit is required.

Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.


Sun Solaris 8_sparc

• Sun 116973-05
  http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21 -116973-05-1

HP Webproxy A.02.10

• HP PHSS_35437
  HP-UX B.11.04 HP Webproxy A.02.10 (Apache 2.x)
  http://itrc.hp.com/

Apache Software Foundation Apache 1.3.26

• Slackware apache-1.3.35-i386-1_slack8.1.tgz
  Slackware 8.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/a pache-1.3.35-i386-1_slack8.1.tgz

Apache Software Foundation Apache 1.3.27

• Slackware apache-1.3.35-i386-1_slack9.0.tgz
  Slackware 9.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/a pache-1.3.35-i386-1_slack9.0.tgz

Apache Software Foundation Apache 1.3.28

• Slackware apache-1.3.35-i486-1_slack9.1.tgz
  Slackware 9.1:
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/a pache-1.3.35-i486-1_slack9.1.tgz

Apache Software Foundation Apache 1.3.31

• Slackware apache-1.3.35-i486-1_slack10.0.tgz
  Slackware 10.0:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ apache-1.3.35-i486-1_slack10.0.tgz


• Ubuntu apache-common_1.3.31-6ubuntu0.9_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3 .31-6ubuntu0.9_amd64.deb


• Ubuntu apache-common_1.3.31-6ubuntu0.9_i386.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3 .31-6ubuntu0.9_i386.deb


• Ubuntu apache-common_1.3.31-6ubuntu0.9_powerpc.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-common_1.3 .31-6ubuntu0.9_powerpc.deb


• Ubuntu apache-dbg_1.3.31-6ubuntu0.9_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1. 3.31-6ubuntu0.9_amd64.deb


• Ubuntu apache-dbg_1.3.31-6ubuntu0.9_i386.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1. 3.31-6ubuntu0.9_i386.deb


• Ubuntu apache-dbg_1.3.31-6ubuntu0.9_powerpc.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-dbg_1. 3.31-6ubuntu0.9_powerpc.deb


• Ubuntu apache-dev_1.3.31-6ubuntu0.9_all.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-dev_1.3.31 -6ubuntu0.9_all.deb


• Ubuntu apache-doc_1.3.31-6ubuntu0.9_all.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-doc_1. 3.31-6ubuntu0.9_all.deb


• Ubuntu apache-perl_1.3.31-6ubuntu0.9_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1 .3.31-6ubuntu0.9_amd64.deb


• Ubuntu apache-perl_1.3.31-6ubuntu0.9_i386.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1 .3.31-6ubuntu0.9_i386.deb


• Ubuntu apache-perl_1.3.31-6ubuntu0.9_powerpc.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-perl_1 .3.31-6ubuntu0.9_powerpc.deb


• Ubuntu apache-ssl_1.3.31-6ubuntu0.9_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1. 3.31-6ubuntu0.9_amd64.deb


• Ubuntu apache-ssl_1.3.31-6ubuntu0.9_i386.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1. 3.31-6ubuntu0.9_i386.deb


• Ubuntu apache-ssl_1.3.31-6ubuntu0.9_powerpc.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache-ssl_1. 3.31-6ubuntu0.9_powerpc.deb


• Ubuntu apache-utils_1.3.31-6ubuntu0.9_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3. 31-6ubuntu0.9_amd64.deb


• Ubuntu apache-utils_1.3.31-6ubuntu0.9_i386.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3. 31-6ubuntu0.9_i386.deb


• Ubuntu apache-utils_1.3.31-6ubuntu0.9_powerpc.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache/apache-utils_1.3. 31-6ubuntu0.9_powerpc.deb


• Ubuntu apache_1.3.31-6ubuntu0.9_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31 -6ubuntu0.9_amd64.deb


• Ubuntu apache_1.3.31-6ubuntu0.9_i386.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31 -6ubuntu0.9_i386.deb


• Ubuntu apache_1.3.31-6ubuntu0.9_powerpc.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/universe/a/apache/apache_1.3.31 -6ubuntu0.9_powerpc.deb


• Ubuntu apache2-common_2.0.50-12ubuntu4.10_amd64.deb
  Ubuntu 4.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.50-12ubuntu4.10_amd64.deb

Apple Mac OS X 10.4.11

• Apple SecUpd2008-002PPC.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002PPC.dmg


• Apple SecUpd2008-002Univ.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002Univ.dmg


• Apple Security Update 2008-003 (Intel)
  http://www.apple.com/support/downloads/securityupdate2008003intel.html


• Apple Security Update 2008-003 (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003ppc.html

Apple Mac OS X Server 10.4.11

• Apple SecUpdSrvr2008-002PPC.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002PPC.dmg


• Apple SecUpdSrvr2008-002Univ.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002Univ.dmg


• Apple Security Update 2008-003 Server (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003serverppc. html


• Apple Security Update 2008-003 Server (Universal)
  http://www.apple.com/support/downloads/securityupdate2008003serveruniv ersal.html

Apache Software Foundation Apache 2.0.40

• RedHat httpd-2.0.40-21.21.legacy.i386.rpm
  Red Hat Linux 9:
  http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-2.0.40-21 .21.legacy.i386.rpm


• RedHat httpd-devel-2.0.40-21.21.legacy.i386.rpm
  Red Hat Linux 9:
  http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-devel-2.0 .40-21.21.legacy.i386.rpm


• RedHat httpd-manual-2.0.40-21.21.legacy.i386.rpm
  Red Hat Linux 9:
  http://download.fedoralegacy.org/redhat/9/updates/i386/httpd-manual-2. 0.40-21.21.legacy.i386.rpm


• RedHat mod_ssl-2.0.40-21.21.legacy.i386.rpm
  Red Hat Linux 9:
  http://download.fedoralegacy.org/redhat/9/updates/i386/mod_ssl-2.0.40- 21.21.legacy.i386.rpm

Apache Software Foundation Apache 2.0.54

• Mandriva apache-base-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-base-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-devel-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-devel-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_cache-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_cache-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_dav-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_dav-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_deflate-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_deflate-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_disk_cache-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_disk_cache-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_file_cache-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_file_cache-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_ldap-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_ldap-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_mem_cache-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_mem_cache-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_proxy-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_proxy-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_userdir-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mod_userdir-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-modules-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-modules-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mpm-peruser-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mpm-peruser-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mpm-prefork-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mpm-prefork-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mpm-worker-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-mpm-worker-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-source-2.0.54-13.2.20060mdk.i586.rpm
  Mandriva Linux 2006.0:
  http://wwwnew.mandriva.com/en/downloads/


• Mandriva apache-source-2.0.54-13.2.20060mdk.x86_64.rpm
  Mandriva Linux 2006.0/X86_64:
  http://wwwnew.mandriva.com/en/downloads/


• Ubuntu apache2-common_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-common_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.54-5ubuntu4_i386.deb


• Ubuntu apache2-common_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2 .0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2-doc_2.0.54-5ubuntu4_all.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0. 54-5ubuntu4_all.deb


• Ubuntu apache2-mpm-perchild_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-mpm-perchild_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.54-5ubuntu4_i386.deb


• Ubuntu apache2-mpm-perchild_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perc hild_2.0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2-mpm-prefork_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-mpm-prefork_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.54-5ubuntu4_i386.deb


• Ubuntu apache2-mpm-prefork_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-pref ork_2.0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2-mpm-threadpool_2.0.54-5ubuntu4_all.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-thre adpool_2.0.54-5ubuntu4_all.deb


• Ubuntu apache2-mpm-worker_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-mpm-worker_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.54-5ubuntu4_i386.deb


• Ubuntu apache2-mpm-worker_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-work er_2.0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2-prefork-dev_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-prefork-dev_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.54-5ubuntu4_i386.deb


• Ubuntu apache2-prefork-dev_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork- dev_2.0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2-threaded-dev_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-threaded-dev_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.54-5ubuntu4_i386.deb


• Ubuntu apache2-threaded-dev_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded -dev_2.0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2-utils_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.54-5ubuntu4_amd64.deb


• Ubuntu apache2-utils_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.54-5ubuntu4_i386.deb


• Ubuntu apache2-utils_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2. 0.54-5ubuntu4_powerpc.deb


• Ubuntu apache2_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.54-5 ubuntu4_amd64.deb


• Ubuntu apache2_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.54-5 ubuntu4_i386.deb


• Ubuntu apache2_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.54-5 ubuntu4_powerpc.deb


• Ubuntu libapr0-dev_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 54-5ubuntu4_amd64.deb


• Ubuntu libapr0-dev_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 54-5ubuntu4_i386.deb


• Ubuntu libapr0-dev_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0. 54-5ubuntu4_powerpc.deb


• Ubuntu libapr0_2.0.54-5ubuntu4_amd64.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.54-5 ubuntu4_amd64.deb


• Ubuntu libapr0_2.0.54-5ubuntu4_i386.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.54-5 ubuntu4_i386.deb


• Ubuntu libapr0_2.0.54-5ubuntu4_powerpc.deb
  Ubuntu 5.10:
  http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.54-5 ubuntu4_powerpc.deb

mod_ssl mod_ssl 2.8.24

• Slackware mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz
  Slackware 10.2:
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz

Apache 'mod_imap' Referer Cross-Site Scripting Vulnerability

References:

• Apache Homepage (Apache Software Foundation)
  
• Apache httpd 1.3 vulnerabilities (Apache Software Foundation)
  
• Apache httpd 2.0 vulnerabilities (Apache Software Foundation)
  
• PK25355; 2.0.47.1: IBM Http server V2.0.47 and V2.0.42 cumulative interim fix (IBM)
  
• RHSA-2006:0158-4 - apache security update (RedHat)
  
• RHSA-2006:0159-8 httpd security update (RedHat)
  
• RHSA-2006:0692-4 - apache security update for Stronghold (RedHat)
  
• Sun Alert ID: 102662 (Sun)
  
• Sun Alert ID: 102663 - Security Vulnerabilities in the Apache 1.3 Web Server 'mo (Sun)
  
• TLSA-2006-1 - Two vulnerabilities discovered in apache (TurboLinux)
  
• HPSBMA02328 SSRT071293 rev.1 - HP OpenView Network Node Manager (OV NNM) Running (HP)
  
• RHSA-2008:0523-1 Low: Red Hat Network Proxy Server security update (Red Hat)