This update fixes multiple bugs in apache :

  - cross site scripting problem in mod_imap (CVE-2007-5000)

  - cross site scripting problem in mod_status     (CVE-2007-6388)

  - cross site scripting problem in the error page for     status code 413 (CVE-2007-6203)

  - cross site scripting problem in mod_proxy_balancer     (CVE-2007-6421)

  - A flaw in mod_proxy_balancer allowed attackers to crash     apache (CVE-2007-6422)

バナーによると、リモートホストにインストールされている Apache 2.2 のバージョンは 2.2.8 より前です。そのようなバージョンは、以下を含むいくつかの問題の影響を受けることがあります。

  - mod_imagemap に関わるクロスサイトスクリプティング問題（CVE-2007-5000）。

  - 不正な形式の HTTP メソッドによる 413 エラーページに関わるクロスサイトスクリプティング問題（PR 44014 / CVE-2007-6203）。

  - リフレッシュパラメーターに関わる mod_status のクロスサイトスクリプティング問題（CVE-2007-6388）。

  - バランサマネージャのワーカールートおよびワーカーリダイレクト文字列に関する mod_proxy_balancer のクロスサイトスクリプティング問題（CVE-2007-6421）。

  - mod_proxy_balancer での balancer_handler 関数のサービス拒否問題は、スレッドされた複数処理モジュールが使用されるとき、認証されたユーザーによってトリガできます（CVE-2007-6422）。

  - mod_proxy_ftp は文字セットを定義しないため、mod_proxy_ftp に、UTF-7 エンコードを使用するクロスサイトスクリプティング問題があります（CVE-2008-0005）。

リモート Web サーバーは、実際にはこれらの脆弱性の影響を受けない場合があることに、注意してください。Nessus は、影響を受けるモジュールが使用されているか、または問題そのものを確認しようとしませんでした。

バナーによると、リモートホストにインストールされている Apache 2.0 のバージョンは 2.0.63 より前です。そのようなバージョンは、以下を含むいくつかの問題の影響を受けることがあります。

  mod_imap に関わるクロスサイトスクリプティング問題。
    （CVE-2007-5000）

  - 不正な形式の HTTP メソッドによる 413 エラーページに関わるクロスサイトスクリプティング問題。（PR 44014 / CVE-2007-6203）

  - リフレッシュパラメータに関わる mod_status クロスサイトスクリプティング問題。（CVE-2007-6388）

  - 文字セットが定義されないため、mod_proxy_ftp で UTF-7 エンコードを使用するクロスサイトスクリプティング問題があります。（CVE-2008-0005）

リモート Web サーバーは、実際にはこれらの脆弱性の影響を受けない場合があることに、注意してください。Nessus は、影響を受けるモジュールが使用されているか、または問題そのものを確認しようとしませんでした。

This update fixes multiple bugs in apache :

  - cross site scripting problem in mod_imap (CVE-2007-5000)

  - cross site scripting problem in mod_status     (CVE-2007-6388)

  - cross site scripting problem in the ftp proxy module     (CVE-2008-0005)

  - cross site scripting problem in the error page for     status code 413 (CVE-2007-6203)

  - cross site scripting problem in mod_proxy_balancer     (CVE-2007-6421)

  - A flaw in mod_proxy_balancer allowed attackers to crash     apache (CVE-2007-6422)

It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2007-6203)

It was discovered that Apache was vulnerable to a cross-site request forgery (CSRF) in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. (CVE-2007-6420)

It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. (CVE-2008-1678)

It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2008-2168)

It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. (CVE-2008-2364)

It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. (CVE-2008-2939).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

根据其标题，远程主机上运行的 Apache 2.2.x 版本低于 2.2.8。因此，该应用程序受到以下漏洞的影响：

  - 涉及 mod_imagemap 的跨站脚本问题 (CVE-2007-5000)。

  - 涉及依靠畸形 HTTP 方法的 413 错误页面的跨站脚本问题 (PR 44014 / CVE-2007-6203)。

  - mod_status 中涉及刷新参数的跨站脚本问题 (CVE-2007-6388)。

  - mod_proxy_balancer 中涉及平衡器的工作路由和工作重定向字符串的跨站脚本问题 (CVE-2007-6421)。

  - mod_proxy_balancer 的 balancer_handler 函数中存在拒绝服务问题，当使用线程化多重处理模块时，经过身份验证的用户可触发此问题 (CVE-2007-6422)。

  - mod_proxy_ftp 中存在使用 UTF-7 编码的跨站脚本问题，因为它不会定义字符集 (CVE-2008-0005)。

请注意远程 Web 服务器实际上可能不会受到这些漏洞的影响。Nessus 没有尝试确定是否正在使用受影响的模块，也没有自行检查问题。

根据其标题，远程主机上运行的 Apache 2.0.x 版本低于 2.0.63。因此，它受到多种跨站脚本漏洞的影响：

  - 涉及 mod_imap 的跨站脚本问题。
    (CVE-2007-5000)

  - 存在涉及 413 错误页面的跨站脚本问题，这是畸形 HTTP 方法所致。(PR 44014 / CVE-2007-6203)

  - mod_status 中存在涉及刷新参数的跨站脚本问题。(CVE-2007-6388)

  - mod_proxy_ftp 中存在使用 UTF-7 编码的跨站脚本问题，这是未定义字符集所致。(CVE-2008-0005)

请注意远程 Web 服务器实际上可能不会受到这些漏洞的影响。Nessus 没有尝试确定是否正在使用受影响的模块，也没有自行检查问题。

根據其標題，遠端主機上執行的 Apache 2.2.x 版本比 2.2.8 舊。因此，該應用程式受到以下弱點影響：

  - 涉及 mod_imagemap 的跨網站指令碼問題 (CVE-2007-5000)。

  - 涉及 413 錯誤頁面的跨網站指令碼問題，此問題是因格式錯誤的 HTTP 方法發生 (PR 44014 / CVE-2007-6203)。

  - 涉及重新整理參數的 mod_status 跨網站指令碼問題 (CVE-2007-6388)。

  - mod_proxy_balancer 中的跨網站指令碼問題，涉及平衡器管理員的背景工作路由和背景工作重新導向字串 (CVE-2007-6421)。

  - mod_proxy_balancer 的 balancer_handler 函數中存在拒絕服務問題，經驗證的使用者可以在使用階層式多處理模組時觸發此問題 (CVE-2007-6422)。

  - mod_proxy_ftp 中使用 UTF-7 編碼的跨網站指令碼問題，因為其未定義字元集 (CVE-2008-0005)。

請注意，遠端 Web 伺服器可能實際上並不會受這些弱點影響。Nessus 並未嘗試判定受影響的模組是否正在使用中，也未嘗試檢查問題本身。

根據其標題，遠端主機上執行的 Apache 2.0.x 版本比 2.0.63 舊。因此會受到多個跨網站指令碼弱點影響：

  - 涉及 mod_imap 的跨網站指令碼問題。
    (CVE-2007-5000)

  - 涉及 413 錯誤頁面的跨網站指令碼問題，此問題是因格式錯誤的 HTTP 方法造成。(PR 44014 / CVE-2007-6203)

  - mod_status 中涉及重新整理參數的跨網站指令碼問題。(CVE-2007-6388)

  - mod_proxy_ftp 中使用 UTF-7 編碼的跨網站指令碼問題，這是因為其未定義字元集。(CVE-2008-0005)

請注意，遠端 Web 伺服器可能實際上並不會受這些弱點影響。Nessus 並未嘗試判定受影響的模組是否正在使用中，也未嘗試檢查問題本身。

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host is affected by the vulnerability described in GLSA-200803-19 (Apache: Multiple vulnerabilities)

    Adrian Pastor and Amir Azam (ProCheckUp) reported that the HTTP Method     specifier header is not properly sanitized when the HTTP return code is     '413 Request Entity too large' (CVE-2007-6203). The mod_proxy_balancer     module does not properly check the balancer name before using it     (CVE-2007-6422). The mod_proxy_ftp does not define a charset in its     answers (CVE-2008-0005). Stefano Di Paola (Minded Security) reported     that filenames are not properly sanitized within the mod_negotiation     module (CVE-2008-0455, CVE-2008-0456).
  Impact :

    A remote attacker could entice a user to visit a malicious URL or send     specially crafted HTTP requests (i.e using Adobe Flash) to perform     Cross-Site Scripting and HTTP response splitting attacks, or conduct a     Denial of Service attack on the vulnerable web server.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.8. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting issue involving mod_imagemap     (CVE-2007-5000).

  - A cross-site scripting issue involving 413 error pages     via a malformed HTTP method (PR 44014 / CVE-2007-6203).

  - A cross-site scripting issue in mod_status involving     the refresh parameter (CVE-2007-6388).

  - A cross-site scripting issue in mod_proxy_balancer     involving the worker route and worker redirect     string of the balancer manager (CVE-2007-6421).

  - A denial of service issue in the balancer_handler     function in mod_proxy_balancer can be triggered by     an authenticated user when a threaded Multi-     Processing Module is used (CVE-2007-6422).

  - A cross-site scripting issue using UTF-7 encoding     in mod_proxy_ftp exists because it does not     define a charset (CVE-2008-0005).

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

According to its banner, the version of Apache 2.0.x running on the remote host is prior to 2.0.63. It is, therefore, affected by multiple cross-site  scripting vulnerabilities :

  - A cross-site scripting issue involving mod_imap.
    (CVE-2007-5000)

  - A cross-site scripting issue involving 413 error pages     via a malformed HTTP method. (PR 44014 / CVE-2007-6203)

  - A cross-site scripting issue in mod_status involving the     refresh parameter. (CVE-2007-6388)

  - A cross-site scripting issue using UTF-7 encoding in     mod_proxy_ftp exists because it does not define a     charset. (CVE-2008-0005)

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

This update fixes multiple bugs in apache :

  - cross-site scripting problem in mod_imap.
    (CVE-2007-5000)

  - cross-site scripting problem in mod_status.
    (CVE-2007-6388)

  - cross-site scripting problem in the ftp proxy module.
    (CVE-2008-0005)

  - cross-site scripting problem in the error page for     status code 413. (CVE-2007-6203)

  - cross-site scripting problem in mod_proxy_balancer.
    (CVE-2007-6421)

  - A flaw in mod_proxy_balancer allowed attackers to crash     apache. (CVE-2007-6422)

This update fixes multiple bugs in apache :

  - cross-site scripting problem in mod_imap.
    (CVE-2007-5000)

  - cross-site scripting problem in mod_status.
    (CVE-2007-6388)

  - cross-site scripting problem in the ftp proxy module.
    (CVE-2008-0005)

  - cross-site scripting problem in the error page for     status code 413. (CVE-2007-6203)

The version of Apache installed on the remote host is advertising a version older than 2.2.8.  Such versions may be affected by several issues, including :

 - A cross-site scripting issue involving mod_imagemap (CVE-2007-5000).

 - A cross-site scripting issue involving 413 error pages via a malformed HTTP method (PR 44014 / CVE-2007-6203).

 - A cross-site scripting issue in mod_status involving the refresh parameter (CVE-2007-6388).

 - A cross-site scripting issue in mod_proxy_balancer involving the worker route and worker redirect string of the balancer manager (CVE-2007-6421).

 - A denial of service issue in the balancer_handler function in mod_proxy_balancer can be triggered by an authenticated user when a threaded Multi-Processing Module is used (CVE-2007-6422).

 - A cross-site scripting issue using UTF-7 encoding in mod_proxy_ftp exists because it does not define a charset (CVE-2008-0005).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
31767	openSUSE 10 Security Update : apache2 (apache2-5127)	Nessus	SuSE Local Security Checks	2008/4/4	2021/1/14	medium
31118	Apache < 2.2.8 の複数の脆弱性（XSS、DoS）	Nessus	Web Servers	2008/2/20	2018/6/29	medium
31407	Apache < 2.0.63 の複数の XSS 脆弱性	Nessus	Web Servers	2008/3/7	2018/6/29	medium
31766	openSUSE 10 Security Update : apache2 (apache2-5126)	Nessus	SuSE Local Security Checks	2008/4/4	2021/1/14	medium
36589	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : apache2 vulnerabilities (USN-731-1)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
31118	Apache 2.2.x < 2.2.8 多个漏洞（XSS、DoS）	Nessus	Web Servers	2008/2/20	2018/6/29	medium
31407	Apache < 2.0.63 多种 XSS 漏洞	Nessus	Web Servers	2008/3/7	2018/6/29	medium
31118	Apache 2.2.x < 2.2.8 多個弱點 (XSS、DoS)	Nessus	Web Servers	2008/2/20	2018/6/29	medium
31407	Apache < 2.0.63 多種 XSS 弱點	Nessus	Web Servers	2008/3/7	2018/6/29	medium
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	2008/3/19	2018/7/14	critical
31445	GLSA-200803-19 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2008/3/13	2021/1/6	medium
31118	Apache 2.2.x < 2.2.8 Multiple Vulnerabilities (XSS, DoS)	Nessus	Web Servers	2008/2/20	2018/6/29	medium
31407	Apache < 2.0.63 Multiple XSS Vulnerabilities	Nessus	Web Servers	2008/3/7	2018/6/29	medium
31765	openSUSE 10 Security Update : apache2 (apache2-5125)	Nessus	SuSE Local Security Checks	2008/4/4	2021/1/14	medium
31768	SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 5128)	Nessus	SuSE Local Security Checks	2008/4/4	2021/1/14	medium
41206	SuSE9 Security Update : Apache 2 (YOU Patch Number 12124)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
4385	Apache < 2.2.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2008/2/20	2019/3/6	high
800581	Apache < 2.2.8 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			low

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

high

low