The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.2.

Mac OS X 10.6.2 contains security fixes for the following products :

  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - Certificate Assistant
  - CoreMedia
  - CUPS
  - Dovecot
  - fetchmail
  - file
  - FTP Server
  - Help Viewer
  - ImageIO
  - IOKit
  - IPSec
  - Kernel
  - Launch Services
  - libsecurity
  - libxml
  - Login Window
  - OpenLDAP
  - QuickDraw Manager
  - QuickTime
  - Screen Sharing
  - Subversion

CVE-2009-2412: allocator alignment fixes Full details here:
http://www.apache.org/dist/apr/patches/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated httpd packages that fix multiple security issues and a bug are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server. The httpd package shipped with Red Hat Enterprise Linux 3 contains embedded copies of the Apache Portable Runtime (APR) libraries, which provide a free library of C data structures and routines, and also additional utility interfaces to support XML parsing, LDAP, database interfaces, URI parsing, and more.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the Apache Portable Runtime (APR) manages memory pool and relocatable memory allocations. An attacker could use these flaws to issue a specially crafted request for memory allocation, which would lead to a denial of service (application crash) or, potentially, execute arbitrary code with the privileges of an application using the APR libraries. (CVE-2009-2412)

A denial of service flaw was found in the Apache mod_deflate module.
This module continued to compress large files until compression was complete, even if the network connection that requested the content was closed before compression completed. This would cause mod_deflate to consume large amounts of CPU if mod_deflate was enabled for a large file. (CVE-2009-1891)

This update also fixes the following bug :

* in some cases the Content-Length header was dropped from HEAD responses. This resulted in certain sites not working correctly with mod_proxy, such as www.windowsupdate.com. (BZ#506016)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. (CVE-2009-2412)

According to its banner, the version of Apache 2.0.x running on the remote host is prior to 2.0.64. It is, therefore, affected by the following vulnerabilities :

  - An unspecified error exists in the handling of requests     without a path segment. (CVE-2010-1452)

  - Several modules, including 'mod_deflate', are     vulnerable to a denial of service attack as the     server can be forced to utilize CPU time compressing     a large file after client disconnect. (CVE-2009-1891)

  - An unspecified error exists in 'mod_proxy' related to     filtration of authentication credentials.     (CVE-2009-3095)  
  - A NULL pointer dereference issue exists in     'mod_proxy_ftp' in some error handling paths.
    (CVE-2009-3094)

  - An error exists in 'mod_ssl' making the server     vulnerable to the TLC renegotiation prefix injection     attack. (CVE-2009-3555)

  - An error exists in the handling of subrequests such     that the parent request headers may be corrupted.
    (CVE-2010-0434)

  - An error exists in 'mod_proxy_http' when handling excessive     interim responses making it vulnerable to a denial of     service attack. (CVE-2008-2364)

  - An error exists in 'mod_isapi' that allows the module     to be unloaded too early, which leaves orphaned callback     pointers. (CVE-2010-0425)

  - An error exists in 'mod_proxy_ftp' when wildcards are     in an FTP URL, which allows for cross-site scripting     attacks. (CVE-2008-2939)

Note that the remote web server may not actually be affected by these vulnerabilities.  Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

Updated apr and apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It aims to provide a free library of C data structures and routines. apr-util is a utility library used with APR. This library provides additional utility interfaces for APR; including support for XML parsing, LDAP, database interfaces, URI parsing, and more.

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the Apache Portable Runtime (APR) manages memory pool and relocatable memory allocations. An attacker could use these flaws to issue a specially crafted request for memory allocation, which would lead to a denial of service (application crash) or, potentially, execute arbitrary code with the privileges of an application using the APR libraries. (CVE-2009-2412)

All apr and apr-util users should upgrade to these updated packages, which contain backported patches to correct these issues. Applications using the APR libraries, such as httpd, must be restarted for this update to take effect.

Multiple security vulnerabilities has been identified and fixed in apr and apr-util :

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third-party information (CVE-2009-2412).

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, related to an underflow flaw.
(CVE-2009-0023).

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564 (CVE-2009-1955).

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input (CVE-2009-1956).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The updated packages have been patched to prevent this.

The following bugs have been fixed : 

  - Integer overflows in libapr could potentially be     exploited to execute arbitrary code. (CVE-2009-2412)

  - Specially crafted XML documents cause apache to consume     large amounts of memory. (CVE-2009-1955)

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2009-006 applied.

This security update contains fixes for the following products :

  - AFP Client
  - Adaptive Firewall
  - Apache
  - Apache Portable Runtime
  - ATS
  - Certificate Assistant
  - CoreGraphics
  - CUPS
  - Dictionary
  - DirectoryService
  - Disk Images
  - Event Monitor
  - fetchmail
  - FTP Server
  - Help Viewer
  - International Components for Unicode
  - IOKit
  - IPSec
  - libsecurity
  - libxml
  - OpenLDAP
  - OpenSSH
  - PHP
  - QuickDraw Manager
  - QuickLook
  - FreeRADIUS
  - Screen Sharing
  - Spotlight
  - Subversion

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
42434	Mac OS X 10.6.x < 10.6.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2009/11/9	2024/5/28	critical
40514	Fedora 11 : apr-1.3.8-1.fc11 (2009-8336)	Nessus	Fedora Local Security Checks	2009/8/10	2021/1/11	critical
40532	CentOS 3 : httpd (CESA-2009:1205)	Nessus	CentOS Local Security Checks	2009/8/11	2021/1/4	critical
42232	openSUSE Security Update : libapr-util1 (libapr-util1-1375)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	critical
42236	SuSE 10 Security Update : libapr (ZYPP Patch Number 6546)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	critical
42323	openSUSE 10 Security Update : libapr-util1 (libapr-util1-6547)	Nessus	SuSE Local Security Checks	2009/10/30	2021/1/14	critical
49877	SuSE 10 Security Update : libapr1 (ZYPP Patch Number 6545)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	critical
50069	Apache 2.0.x < 2.0.64 Multiple Vulnerabilities	Nessus	Web Servers	2010/10/20	2018/6/29	high
40542	RHEL 4 / 5 : apr and apr-util (RHSA-2009:1204)	Nessus	Red Hat Local Security Checks	2009/8/11	2021/1/14	critical
42234	SuSE 11 Security Update : libapr (SAT Patch Number 1374)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	critical
43000	Mandriva Linux Security Advisory : apr (MDVSA-2009:314)	Nessus	Mandriva Local Security Checks	2009/12/4	2021/1/6	critical
46217	SuSE9 Security Update : Apache 2 (YOU Patch Number 12613)	Nessus	SuSE Local Security Checks	2010/5/4	2021/1/14	critical
42433	Mac OS X Multiple Vulnerabilities (Security Update 2009-006)	Nessus	MacOS X Local Security Checks	2009/11/9	2024/5/28	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical