CVE:CVE-2002-0840
CNNVD:CNNVD-200210-265
Apache是一款广泛使用的开放源代码WEB服务程序。Apache的对默认错误页面的处理存在问题，攻击者可以利用此漏洞执行跨站脚本攻击。起因是没有正确的过滤SSI错误页面的恶意HTML代码。攻击者可以利用这个漏洞在访问恶意链接的客户端执行HTML和脚本代码，导致控制Web内容或窃取基于cookie的认证凭证。请注意仅在UseCanonicalName设置为Off且服务器运行在使用了通配符DNS的域中的情况下才可能利用这个漏洞。
solution:Upgrade apache http_server to a higher version than 1.3,1.3.1,1.3.3,1.3.4,1.3.6,1.3.9,1.3.11,1.3.12,1.3.14,1.3.17,1.3.18,1.3.19,1.3.20,1.3.22,1.3.23,1.3.24,1.3.25,1.3.26,2.0,2.0.28,2.0.32,2.0.35,2.0.36,2.0.37,2.0.38,2.0.39,2.0.40,2.0.41,2.0.42,and avoid the version 1.3,1.3.1,1.3.3,1.3.4,1.3.6,1.3.9,1.3.11,1.3.12,1.3.14,1.3.17,1.3.18,1.3.19,1.3.20,1.3.22,1.3.23,1.3.24,1.3.25,1.3.26,2.0,2.0.28,2.0.32,2.0.35,2.0.36,2.0.37,2.0.38,2.0.39,2.0.40,2.0.41,2.0.42; Upgrade oracle application_server to a higher version than 1.0.2,1.0.2.1s,1.0.2.2,9.0.2,9.0.2:r2,9.0.2.1,and avoid the version 1.0.2,1.0.2.1s,1.0.2.2,9.0.2,9.0.2:r2,9.0.2.1; Upgrade oracle database_server to a higher version than 8.1.7,9.2.1,9.2.2,and avoid the version 8.1.7,9.2.1,9.2.2; Upgrade oracle oracle8i to a higher version than 8.1.7,8.1.7.1,8.1.7_.0.0_enterprise,8.1.7_.1.0_enterprise,and avoid the version 8.1.7,8.1.7.1,8.1.7_.0.0_enterprise,8.1.7_.1.0_enterprise; Upgrade oracle oracle9i to a higher version than 9.0,9.0.1,9.0.1.2,9.0.1.3,9.0.2,and avoid the version 9.0,9.0.1,9.0.1.2,9.0.1.3,9.0.2