mod_negotiation XSS via untrusted file names in directories with MultiViews enabled
CVE: CVE-2008-0455
Component: httpd
CWE: CWE-79
Severity: Low
Release date: 2008-01-01T00:00:00+00:00

Cross-site scripting (XSS) vulnerability in the mod_negotiation module in the Apache HTTP Server 2.2.6 and earlier in the 2.2.x series, 2.0.61 and earlier in the 2.0.x series, and 1.3.39 and earlier in the 1.3.x series allows remote authenticated users to inject arbitrary web script or HTML by uploading a file with a name containing XSS sequences and a file extension, which leads to injection within a (1) "406 Not Acceptable" or (2) "300 Multiple Choices" HTTP response when the extension is omitted in a request for the file.


Remediation:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat
Enterprise Linux 5 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
JBoss Enterprise Application Platform 6 configuration files. On update, the
configuration files that have been locally modified will not be updated.
The updated version of such files will be stored as the rpmnew files. Make
sure to locate any such files after the update and merge any changes
manually.

For more details, refer to the Release Notes for JBoss Enterprise
Application Platform 6.0.1, available shortly from
https://access.redhat.com/knowledge/docs/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
All users of JBoss Enterprise Application Platform 6.0.0 on Red Hat
Enterprise Linux 6 are advised to upgrade to these updated packages. The
JBoss server process must be restarted for the update to take effect.

Before applying this update, make sure all previously released errata
relevant to your system have been applied. Also, back up any customized
JBoss Enterprise Application Platform 6 configuration files. On update, the
configuration files that have been locally modified will not be updated.
The updated version of such files will be stored as the rpmnew files. Make
sure to locate any such files after the update and merge any changes
manually.

For more details, refer to the Release Notes for JBoss Enterprise
Application Platform 6.0.1, available shortly from
https://access.redhat.com/knowledge/docs/

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258
Users of JBoss Enterprise Application Platform 6.0.0 as provided from the
Red Hat Customer Portal are advised to upgrade to JBoss Enterprise
Application Platform 6.0.1.

The References section of this erratum contains a download link (you must
log in to download the update). Before applying this update, back up your
existing JBoss Enterprise Application Platform installation and deployed
applications.