RedHatLinuxApache remote user name list Vulnerability

RedHatLinuxApache remote list of user name vulnerabilities-Linux Enterprise Application-Linux server application information. The following is a detailed description. Affected Systems: RedHat Linux 7.0
　　
Description:
--------------------------------------------------------------------------------
　　
Bugtraq id: 3335
　　
Apache released along with Red Hat Linux 7.0 has a configuration error, which may cause remote attackers to list
The user on the host.
　　
If a remote attacker sends the following request,
Http://www.example.com /"
Generally, there are three situations:
　　
1. If a user exists and has configured his/her personal homepage, the server returns to the user's homepage.
2. If the user does not configure his/her personal homepage, the server returns:
"You don \'t have permission to access/" username on this server ."
3. If the user does not exist, the server returns:
"The requested URL/" username was not found on this server ."
　　
Different error messages are returned in different situations, which may cause remote attackers to list host user names.
　　
　　
　　
　　
　　
　　
--------------------------------------------------------------------------------
Suggestion:
We recommend that you use the following temporary solution before installing the patch:
　　
1. Disable the default "UserDir" option
% Echo \ 'userdir Disabled \ '>/var/www/conf/httpd. conf
　　
2. Replace the path name URL
% Echo \ 'errordocument 404 http: // localhost/sample.html \ '>
/Var/www/conf/httpd. conf
% Echo \ 'errordocument 403 http: // localhost/sample.html \ '>
/Var/www/conf/httpd. conf
% Sudo apachectl restart
　　
Vendor patch:
　　
Currently, the vendor has not provided patches or upgrade programs. We recommend that users who use the software keep an eye on the vendor.
Homepage to get the latest version:
Http://www.redhat.com