Skip to content

Security Advisory 中（Moderate）：httpdのセキュリティアップデート

アップデートID:

RHSA-2007:0662-2

タイプ:Security Advisory
重大性:Moderate
発行日:2007年7月13日
最終更新日:2007年7月13日
影響のある製品: Red Hat Desktop (v. 3)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Enterprise Linux WS (v. 4)
OVAL: https://rhn.redhat.com/errata/RHSA-2007-0662.html
CVEs (cve.mitre.org): CVE-2007-3304

詳細

セキュリティ問題を修正したApache httpdのアップデートパッケージが、Red Hat Enterprise Linux 3および4で利用可能になりました。

このアップデートは、レッドハットセキュリティ対策チームによって、深刻度「中（Moderate）」のセキュリティ問題と評価されています。

Apache HTTP Serverは、広く使用されているWebサーバです。

Apache HTTP Serverによって信号が送られる前に、プロセスがApacheの子プロセスであることが確認されていませんでした。Apache HTTP Serverでスクリプトを実行できるローカル攻撃者が、スコアボードを操作して任意のプロセスを終了できるため、サービス拒否が引き起こされる可能性があります。（CVE-2007-3304）

httpdのユーザは、この問題を修正するバックポートパッチを含む上記アップデートパッケージにアップグレードしてください。ユーザは、このアップデートをインストールしたあとにApacheを再起動する必要があります。


解決法


このアップデートを適用する前に、ご使用のシステムに関係するリリース済みのエラータ/Errataがすべて適用されていることを確認してください。

このアップデートは、Red Hat Networkを通じて入手できます。


アップデートパッケージ

Red Hat Desktop (v. 3)
SRPMS:
httpd-2.0.46-68.ent.src.rpm     04de0fb255872ee653842ca34316ad31
 
IA-32:
httpd-2.0.46-68.ent.i386.rpm     45c45a284cdab73aeebb862525f2ede7
httpd-devel-2.0.46-68.ent.i386.rpm     7de1d694f50b018a3ef0c75d82239935
mod_ssl-2.0.46-68.ent.i386.rpm     8ed0d653d5a77352750851fd7a1bf31f
 
x86_64:
httpd-2.0.46-68.ent.x86_64.rpm     5e2133732637c3d68f5c18159689cd5a
httpd-devel-2.0.46-68.ent.x86_64.rpm     305cbfae95e99237871c54f74a92ee4b
mod_ssl-2.0.46-68.ent.x86_64.rpm     7b617b1877d5c84d54b619fda1da2c6e
 
Red Hat Desktop (v. 4)
SRPMS:
httpd-2.0.52-32.3.ent.src.rpm     98d72890a6b6ca504b3a4117b39a9cb8
 
IA-32:
httpd-2.0.52-32.3.ent.i386.rpm     3d49e62ddef5e26af310e695e1c85942
httpd-devel-2.0.52-32.3.ent.i386.rpm     7cd552fd590b098795e96eb44a319a24
httpd-manual-2.0.52-32.3.ent.i386.rpm     b6b8a6a9aeda14dcc1e1002ae75ff166
httpd-suexec-2.0.52-32.3.ent.i386.rpm     259e29621f37bc98f7414459a6d0a7ba
mod_ssl-2.0.52-32.3.ent.i386.rpm     acaeb0a82c710af77ff3948736774a27
 
x86_64:
httpd-2.0.52-32.3.ent.x86_64.rpm     6e2eefa4b8cc1ab593792107718256af
httpd-devel-2.0.52-32.3.ent.x86_64.rpm     92ec83cb5f718fdcfe430e61662bcfae
httpd-manual-2.0.52-32.3.ent.x86_64.rpm     d134b7e7091f1be16435cd76241bf6d9
httpd-suexec-2.0.52-32.3.ent.x86_64.rpm     ea93db5243587f9e2043fa4f0b109224
mod_ssl-2.0.52-32.3.ent.x86_64.rpm     5de43b0430642a8c1ac2d900db03a58c
 
Red Hat Enterprise Linux AS (v. 3)
SRPMS:
httpd-2.0.46-68.ent.src.rpm     04de0fb255872ee653842ca34316ad31
 
IA-32:
httpd-2.0.46-68.ent.i386.rpm     45c45a284cdab73aeebb862525f2ede7
httpd-devel-2.0.46-68.ent.i386.rpm     7de1d694f50b018a3ef0c75d82239935
mod_ssl-2.0.46-68.ent.i386.rpm     8ed0d653d5a77352750851fd7a1bf31f
 
IA-64:
httpd-2.0.46-68.ent.ia64.rpm     926247832f94dfd72401b05f525f2e20
httpd-devel-2.0.46-68.ent.ia64.rpm     47168f2b3cb197eec527331e166e0a48
mod_ssl-2.0.46-68.ent.ia64.rpm     87477843557016c9c84f34c68500175d
 
PPC:
httpd-2.0.46-68.ent.ppc.rpm     42f51fe41d491ace05c74ca17d78fe46
httpd-devel-2.0.46-68.ent.ppc.rpm     a09210d5c9e0912f6299ad1c5f4c0bec
mod_ssl-2.0.46-68.ent.ppc.rpm     0e4dfbe87cabee593054d7ca4627073b
 
s390:
httpd-2.0.46-68.ent.s390.rpm     558efe236ba18cf1cebe60bfc9a356f9
httpd-devel-2.0.46-68.ent.s390.rpm     a908d0d57a07d7e574c8aeda7e0dc8d1
mod_ssl-2.0.46-68.ent.s390.rpm     b8b21f7acd5fd8e277d0b2261dbba9d1
 
s390x:
httpd-2.0.46-68.ent.s390x.rpm     988d27fe858348482b019927bc5db50a
httpd-devel-2.0.46-68.ent.s390x.rpm     0dadb504ce4aea5a65e97530d91f01f4
mod_ssl-2.0.46-68.ent.s390x.rpm     5f64f5d1510bff857dbd6e2e2a1ec221
 
x86_64:
httpd-2.0.46-68.ent.x86_64.rpm     5e2133732637c3d68f5c18159689cd5a
httpd-devel-2.0.46-68.ent.x86_64.rpm     305cbfae95e99237871c54f74a92ee4b
mod_ssl-2.0.46-68.ent.x86_64.rpm     7b617b1877d5c84d54b619fda1da2c6e
 
Red Hat Enterprise Linux AS (v. 4)
SRPMS:
httpd-2.0.52-32.3.ent.src.rpm     98d72890a6b6ca504b3a4117b39a9cb8
 
IA-32:
httpd-2.0.52-32.3.ent.i386.rpm     3d49e62ddef5e26af310e695e1c85942
httpd-devel-2.0.52-32.3.ent.i386.rpm     7cd552fd590b098795e96eb44a319a24
httpd-manual-2.0.52-32.3.ent.i386.rpm     b6b8a6a9aeda14dcc1e1002ae75ff166
httpd-suexec-2.0.52-32.3.ent.i386.rpm     259e29621f37bc98f7414459a6d0a7ba
mod_ssl-2.0.52-32.3.ent.i386.rpm     acaeb0a82c710af77ff3948736774a27
 
IA-64:
httpd-2.0.52-32.3.ent.ia64.rpm     6e7bf610578b828450e32e23855f180a
httpd-devel-2.0.52-32.3.ent.ia64.rpm     fa6524d8755fbe467f4b122c1fc5d105
httpd-manual-2.0.52-32.3.ent.ia64.rpm     f073506a8dda759b9d806c4ff2ff7d28
httpd-suexec-2.0.52-32.3.ent.ia64.rpm     f127172ad25744bcb4584240aa2e3484
mod_ssl-2.0.52-32.3.ent.ia64.rpm     b5e97f1a2ae1da9fa04ae6af00766f1d
 
PPC:
httpd-2.0.52-32.3.ent.ppc.rpm     cb7e74df0b687d41515c00aa6c2f7f20
httpd-devel-2.0.52-32.3.ent.ppc.rpm     46d384d93a7001f25c11f934d25afdbe
httpd-manual-2.0.52-32.3.ent.ppc.rpm     6473cc4f012c92370f94b14c461c5939
httpd-suexec-2.0.52-32.3.ent.ppc.rpm     95257fffaee90696acc675000f2534cd
mod_ssl-2.0.52-32.3.ent.ppc.rpm     82e75075008ad95c8069354f968bf4ec
 
s390:
httpd-2.0.52-32.3.ent.s390.rpm     304dae15da3cb2f2b1a88bca696ab205
httpd-devel-2.0.52-32.3.ent.s390.rpm     ce3b6afc7f6f6d55fe72fa70141c4204
httpd-manual-2.0.52-32.3.ent.s390.rpm     27ce295c7088caeb41a9431653c0e778
httpd-suexec-2.0.52-32.3.ent.s390.rpm     55c10fb0b5242f499300f793fb17f650
mod_ssl-2.0.52-32.3.ent.s390.rpm     df04d6a0aa1b49e02fb72030cd3d538c
 
s390x:
httpd-2.0.52-32.3.ent.s390x.rpm     5581919570c0644978581fab6fa5ed12
httpd-devel-2.0.52-32.3.ent.s390x.rpm     e33cf6da4e4a25d4ebe58f73d39be7fa
httpd-manual-2.0.52-32.3.ent.s390x.rpm     f8692011da91875de1195449c7fce3b8
httpd-suexec-2.0.52-32.3.ent.s390x.rpm     edca1601a6d67a4c586d674f384a8742
mod_ssl-2.0.52-32.3.ent.s390x.rpm     92f65dcb29479c9c10eb8aeaaef6e900
 
x86_64:
httpd-2.0.52-32.3.ent.x86_64.rpm     6e2eefa4b8cc1ab593792107718256af
httpd-devel-2.0.52-32.3.ent.x86_64.rpm     92ec83cb5f718fdcfe430e61662bcfae
httpd-manual-2.0.52-32.3.ent.x86_64.rpm     d134b7e7091f1be16435cd76241bf6d9
httpd-suexec-2.0.52-32.3.ent.x86_64.rpm     ea93db5243587f9e2043fa4f0b109224
mod_ssl-2.0.52-32.3.ent.x86_64.rpm     5de43b0430642a8c1ac2d900db03a58c
 
Red Hat Enterprise Linux ES (v. 3)
SRPMS:
httpd-2.0.46-68.ent.src.rpm     04de0fb255872ee653842ca34316ad31
 
IA-32:
httpd-2.0.46-68.ent.i386.rpm     45c45a284cdab73aeebb862525f2ede7
httpd-devel-2.0.46-68.ent.i386.rpm     7de1d694f50b018a3ef0c75d82239935
mod_ssl-2.0.46-68.ent.i386.rpm     8ed0d653d5a77352750851fd7a1bf31f
 
IA-64:
httpd-2.0.46-68.ent.ia64.rpm     926247832f94dfd72401b05f525f2e20
httpd-devel-2.0.46-68.ent.ia64.rpm     47168f2b3cb197eec527331e166e0a48
mod_ssl-2.0.46-68.ent.ia64.rpm     87477843557016c9c84f34c68500175d
 
x86_64:
httpd-2.0.46-68.ent.x86_64.rpm     5e2133732637c3d68f5c18159689cd5a
httpd-devel-2.0.46-68.ent.x86_64.rpm     305cbfae95e99237871c54f74a92ee4b
mod_ssl-2.0.46-68.ent.x86_64.rpm     7b617b1877d5c84d54b619fda1da2c6e
 
Red Hat Enterprise Linux ES (v. 4)
SRPMS:
httpd-2.0.52-32.3.ent.src.rpm     98d72890a6b6ca504b3a4117b39a9cb8
 
IA-32:
httpd-2.0.52-32.3.ent.i386.rpm     3d49e62ddef5e26af310e695e1c85942
httpd-devel-2.0.52-32.3.ent.i386.rpm     7cd552fd590b098795e96eb44a319a24
httpd-manual-2.0.52-32.3.ent.i386.rpm     b6b8a6a9aeda14dcc1e1002ae75ff166
httpd-suexec-2.0.52-32.3.ent.i386.rpm     259e29621f37bc98f7414459a6d0a7ba
mod_ssl-2.0.52-32.3.ent.i386.rpm     acaeb0a82c710af77ff3948736774a27
 
IA-64:
httpd-2.0.52-32.3.ent.ia64.rpm     6e7bf610578b828450e32e23855f180a
httpd-devel-2.0.52-32.3.ent.ia64.rpm     fa6524d8755fbe467f4b122c1fc5d105
httpd-manual-2.0.52-32.3.ent.ia64.rpm     f073506a8dda759b9d806c4ff2ff7d28
httpd-suexec-2.0.52-32.3.ent.ia64.rpm     f127172ad25744bcb4584240aa2e3484
mod_ssl-2.0.52-32.3.ent.ia64.rpm     b5e97f1a2ae1da9fa04ae6af00766f1d
 
x86_64:
httpd-2.0.52-32.3.ent.x86_64.rpm     6e2eefa4b8cc1ab593792107718256af
httpd-devel-2.0.52-32.3.ent.x86_64.rpm     92ec83cb5f718fdcfe430e61662bcfae
httpd-manual-2.0.52-32.3.ent.x86_64.rpm     d134b7e7091f1be16435cd76241bf6d9
httpd-suexec-2.0.52-32.3.ent.x86_64.rpm     ea93db5243587f9e2043fa4f0b109224
mod_ssl-2.0.52-32.3.ent.x86_64.rpm     5de43b0430642a8c1ac2d900db03a58c
 
Red Hat Enterprise Linux WS (v. 3)
SRPMS:
httpd-2.0.46-68.ent.src.rpm     04de0fb255872ee653842ca34316ad31
 
IA-32:
httpd-2.0.46-68.ent.i386.rpm     45c45a284cdab73aeebb862525f2ede7
httpd-devel-2.0.46-68.ent.i386.rpm     7de1d694f50b018a3ef0c75d82239935
mod_ssl-2.0.46-68.ent.i386.rpm     8ed0d653d5a77352750851fd7a1bf31f
 
IA-64:
httpd-2.0.46-68.ent.ia64.rpm     926247832f94dfd72401b05f525f2e20
httpd-devel-2.0.46-68.ent.ia64.rpm     47168f2b3cb197eec527331e166e0a48
mod_ssl-2.0.46-68.ent.ia64.rpm     87477843557016c9c84f34c68500175d
 
x86_64:
httpd-2.0.46-68.ent.x86_64.rpm     5e2133732637c3d68f5c18159689cd5a
httpd-devel-2.0.46-68.ent.x86_64.rpm     305cbfae95e99237871c54f74a92ee4b
mod_ssl-2.0.46-68.ent.x86_64.rpm     7b617b1877d5c84d54b619fda1da2c6e
 
Red Hat Enterprise Linux WS (v. 4)
SRPMS:
httpd-2.0.52-32.3.ent.src.rpm     98d72890a6b6ca504b3a4117b39a9cb8
 
IA-32:
httpd-2.0.52-32.3.ent.i386.rpm     3d49e62ddef5e26af310e695e1c85942
httpd-devel-2.0.52-32.3.ent.i386.rpm     7cd552fd590b098795e96eb44a319a24
httpd-manual-2.0.52-32.3.ent.i386.rpm     b6b8a6a9aeda14dcc1e1002ae75ff166
httpd-suexec-2.0.52-32.3.ent.i386.rpm     259e29621f37bc98f7414459a6d0a7ba
mod_ssl-2.0.52-32.3.ent.i386.rpm     acaeb0a82c710af77ff3948736774a27
 
IA-64:
httpd-2.0.52-32.3.ent.ia64.rpm     6e7bf610578b828450e32e23855f180a
httpd-devel-2.0.52-32.3.ent.ia64.rpm     fa6524d8755fbe467f4b122c1fc5d105
httpd-manual-2.0.52-32.3.ent.ia64.rpm     f073506a8dda759b9d806c4ff2ff7d28
httpd-suexec-2.0.52-32.3.ent.ia64.rpm     f127172ad25744bcb4584240aa2e3484
mod_ssl-2.0.52-32.3.ent.ia64.rpm     b5e97f1a2ae1da9fa04ae6af00766f1d
 
x86_64:
httpd-2.0.52-32.3.ent.x86_64.rpm     6e2eefa4b8cc1ab593792107718256af
httpd-devel-2.0.52-32.3.ent.x86_64.rpm     92ec83cb5f718fdcfe430e61662bcfae
httpd-manual-2.0.52-32.3.ent.x86_64.rpm     d134b7e7091f1be16435cd76241bf6d9
httpd-suexec-2.0.52-32.3.ent.x86_64.rpm     ea93db5243587f9e2043fa4f0b109224
mod_ssl-2.0.52-32.3.ent.x86_64.rpm     5de43b0430642a8c1ac2d900db03a58c
 
(The unlinked packages above are only available from the Red Hat Network)


バグフィックス (詳細は、bugzilla/バグジラ[英語]を御覧ください。)

245111 - CVE-2007-3304 httpd scoreboard lack of PID protection


参照


http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3304
http://www.redhat.com/security/updates/classification/#moderate


ここに在るパッケージはセキュリティの為、Red Hat, Inc. によって、GPG認証されています。
認証キー及び詳細は以下を御覧下さい。
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/