Director 5.4 and 5.5.1.1 use Apache httpd version 2.0.63.  The version of Apache has several publicly documented vulnerabilities.

The most severe vulnerability allows an attacker to gain complete control over a Director installation.  The attacker can view and modify configuration data as well as data sent to and from Director.  An attacker can also render Director completely unresponsive for administrative control as well as data transmission.

When Director is deployed behind a firewall, as is recommended, an attacker must gain access from the internal network in order to mount an attack.  The CVSS base scores included in this advisory are based on this deployment scenario.

If Director is deployed outside of the firewall, the CVSS base score for all CVEs listed would be higher. The CVSS base score for this security advisory would be a 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C).

Director 5.5.2.3 contains an upgrade to Apache httpd version 2.0.64 fixing the CVEs documented in this security advisory.