I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:
Apache/2.2.3 (Red Hat) Server at ... Port 80
Is revealing this information a security risk?
Revealing that information is a security risk, in the context of a security assesment of your website. (I'm talking about checkbox style assesments here)
Nothing more than that - it just makes fingerprinting the webserver more difficult, but by no means impossible - not even hard. It will not hinder any attacker specifically targeting the website not even a bit, although it will force him to take actions that will possibly hit some IDS. It may hinder some automated crawlers or mass attacks. though.
I would categorise this to the 'best practices' list.
Directly, no. This is a matter of security through obscurity. Removing the server headers do not remove the vulnerabilities and functions associated with it.
In the context of risk, it might decrease the possibility to be targeted by some automated bots who rely on fingerprinting your services. The consequences would remain the same.
This question have already covered this discussion about security through obscurity to a good extent.
It definitely provides some interesting information to possible attackers about your system (operating system, web server type and version). So i guess that it would be wise to either remove that information completely or change to something more generic/user friendly.
You should check your httpd.conf file for