Secunia

Description

Ubuntu has issued an update for apache. This fixes some vulnerabilities, which can be exploited by malicious, local users to cause a DoS (Denial of Service) and malicious people to conduct cross-site scripting attacks.

1) An error exists in the mod_status module where the server-status page does not specify a charset . This can be exploited to execute arbitrary HTML and script code in an administrator's browser session in context of an affected site.

2) An error in the Multi-Processing Module (MPM) can be exploited to send signals to arbitrary processes and cause them to be terminated.

3) An error in the mod_cache module in the handling of Cache-Control headers can be exploited to crash the child process via specially crafted requests. This could lead to a DoS if using a threaded Multi-Processing Module.

Solution
Apply updated packages.
Further details available in Customer Area

Original Advisory
http://www.ubuntu.com/usn/usn-499-1

Deep Links
Links available in Customer Area