https://www.exploit-db.com/exploits/21885
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200210-265

Apache是一款广泛使用的开放源代码WEB服务程序。Apache的对默认错误页面的处理存在问题，攻击者可以利用此漏洞执行跨站脚本攻击。起因是没有正确的过滤SSI错误页面的恶意HTML代码。攻击者可以利用这个漏洞在访问恶意链接的客户端执行HTML和脚本代码，导致控制Web内容或窃取基于cookie的认证凭证。请注意仅在UseCanonicalName设置为Off且服务器运行在使用了通配符DNS的域中的情况下才可能利用这个漏洞。

source: http://www.securityfocus.com/bid/5847/info

Apache is reported to be vulnerable to cross site scripting attacks. This vulnerability is due to the SSI error pages of the webserver not being properly sanitized of malicious HTML code.

Attacker-supplied HTML and script code may be executed on a web client visiting the malicious link in the context of the webserver.

Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28document%2Ecookie%29%22
%3E.apachesite.org/raise_404

来源:US-CERTVulnerabilityNote:VU#240329
名称:VU#240329
链接:http://www.kb.cert.org/vuls/id/240329
来源:BUGTRAQ
名称:20021002Apache2Cross-SiteScripting
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=103357160425708&w;=2
来源:XF
名称:apache-http-host-xss(10241)
链接:http://xforce.iss.net/xforce/xfdb/10241
来源:www.apacheweek.com
链接:http://www.apacheweek.com/issues/02-10-04
来源:BID
名称:5847
链接:http://www.securityfocus.com/bid/5847
来源:REDHAT
名称:RHSA-2003:106
链接:http://www.redhat.com/support/errata/RHSA-2003-106.html
来源:REDHAT
名称:RHSA-2002:251
链接:http://www.redhat.com/support/errata/RHSA-2002-251.html
来源:REDHAT
名称:RHSA-2002:248
链接:http://www.redhat.com/support/errata/RHSA-2002-248.html
来源:REDHAT
名称:RHSA-2002:244
链接:http://www.redhat.com/support/errata/RHSA-2002-244.html
来源:REDHAT
名称:RHSA-2002:243
链接:http://www.redhat.com/support/errata/RHSA-2002-243.html
来源:REDHAT
名称:RHSA-2002:222
链接:http://www.redhat.com/support/errata/RHSA-2002-222.html
来源:OSVDB
名称:862
链接:http://www.osvdb.org/862
来源:ENGARDE
名称:ESA-20021007-024