30 May 2013, 12:25

Log file vulnerability in Apache server

Apache feather A security hole that allows attackers to take control of the server has been found in Apache. The vulnerability is contained in the do_rewritelog() log function of mod_rewrite. This function insufficiently filters the data that is written to the log file. Attackers can potentially use specially crafted HTTP requests to inject escape sequences into the log file, which could possibly cause the server to execute commands without the administrator's authorisation when the log file is displayed in the terminal.

2.2.x versions of Apache are vulnerable, but other branches may also be affected. Currently, the only way of mitigating the issue is to apply a patch. Red Hat Enterprise Linux users will find the issue has been fixed in RHEL 5 and 6 updates.

(sno)

« previous | next »

Print Version | Send by email | Permalink: http://h-online.com/-1873651