根据其自我报告的版本，远程主机上运行的 Nessus Network Monitor 版本低于 6.2.2 版。因此，它受到 TNS-2023-23 公告中提及的多个漏洞影响。已发现多个第三方组件包含漏洞，供应商已提供更新版本。出于谨慎考虑且符合最佳实践，Tenable 选择升级这些组件，以解决这些问题的潜在影响。Nessus Network Monitor 6.2.2 更新了以下组件：

  - 将 c-ares 版本从 1.10.0 更新到 1.19.1。
  - 将 curl 版本从 7.79.1 更新到 8.1.2。
  - 将 libbzip2 版本从 1.0.6 更新到 1.0.8。
  - 将 libpcre 版本从 8.42 更新到 8.44。
  - 将 libxml2 版本从 2.7.7 更新到 2.11.1。
  - 将 libxslt 版本从 1.1.26 更新到 1.1.37。
  - 将 libxmlsec 版本从 1.2.18 更新到 1.2.37。
  - 将 sqlite 版本从 3.27.2 更新到 3.40.1。
  - 将 jQuery Cookie 版本从 1.3.1 更新到 1.4.1。
  - 将 jQuery UI 版本从 1.13.0 更新到 1.13.2。
  - 将 OpenSSL 版本从 3.0.8 更新到 3.0.9。

遠端 Redhat Enterprise Linux 6/7 主機上安裝的套件受到 RHSA-2017:0002 公告中提及的多個弱點影響。

    Node.js 是一種構建在 Chrome 之 JavaScript 執行階段上的平台，適用於輕易地構建快速、可擴充的網路應用程式。Node.js 使用一個以事件為導向的非封鎖 I/O 模型，使其更為輕量及更有效率、適用於跨分散式裝置的資料密集型即時應用程式。

    下列套件已升級至更新的上游版本：rh-nodejs4-nodejs (4.6.2)、rh-nodejs4-http-parser (2.7.0)。(BZ#1388097)

    安全性修正：

    * 據發現，Node.js 的 tls.checkServerIdentity() 函式並未正確驗證含有萬用字元的伺服器憑證。惡意 TLS 伺服器可利用此缺陷，取得 Node.js TLS 用戶端所接受的特製憑證。(CVE-2016-7099)

    * 據發現，配置新記憶體時，V8 Zone 類別容易發生整數溢位 (Zone::New() 和 Zone::NewExpand())。能夠操控大型區域的攻擊者可使應用程式損毀，或可能以應用程式權限執行任意程式碼。(CVE-2016-1669)

    * 在 Node.js 隨附的 DNS 解析器程式庫 c-ares 中發現一個弱點。具有逸出結尾點的主機名稱有大小計算不正確的情形，進而導致單一位元組在堆積上的寫入位置超過緩衝區末端。能夠將此種主機名稱提供給使用 c-ares 的應用程式的攻擊者可能會使該應用程式損毀。(CVE-2016-5180)

    * 據發現，ServerResponse#writeHead() 中的 reason 引數未經過正確驗證。遠端攻擊者可能會利用此缺陷，透過特製的 HTTP 要求，發動 HTTP 回應分割攻擊。(CVE-2016-5325)

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Gzob Qq 發現 c-ares (非同步 DNS 要求程式庫) 中的查詢構建函式未正確處理建構的查詢名稱，進而導致堆積緩衝區溢位，並且可能造成任意程式碼執行。

Gzob Qq 發現 c-ares 未正確處理某些主機名稱。
遠端攻擊者可利用此問題造成使用 c-ares 的應用程式損毀，進而導致拒絕服務或可能執行任意程式碼。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

根據其自我報告的版本號碼，遠端主機上執行的 Nessus Network Monitor 低於 6.2.2 版。因此，會受到 TNS-2023-23 公告中所提及的多個弱點影響。由於發現多個第三方元件中存在弱點，廠商已提供更新版。出於慎重和符合良好實務，Tenable 選擇升級這些元件，以解決這些問題的潛在影響。Nessus Network Monitor 6.2.2 更新了下列元件：

  - 1.10.0 版到 1.19.1 版的 c-ares。
  - 7.79.1 版到 8.1.2 版的 curl。
  - 1.0.6 版到 1.0.8 版的 libbzip2。
  - 8.42 版到 8.44 版的 libpcre。
  - 2.7.7 版到 2.11.1 版的 libxml2。
  - 1.1.26 版到 1.1.37 版的 libxslt。
  - 1.2.18 版到 1.2.37 版的 libxmlsec。
  - 3.27.2 版到 3.40.1 版的 sqlite。
  - 1.3.1 版到 1.4.1 版的 jQuery Cookie。
  - 1.13.0 版到 1.13.2 版的 jQuery UI。
  - 3.0.8 版到 3.0.9 版的 OpenSSL。

This update for nodejs4 fixes the following issues: Security issues fixed :

  - CVE-2016-5180: c-ares: Fix for single-byte buffer     overwrite (bsc#1007728). Bug fixes :

  - bsc#1009011: npm4 should provide versioned nodejs-npm     and npm allowing nodejs-packaging to continue to     function properly in Leap 42.2

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\\.') would have     its size calculated incorrectly, leading to a single     byte written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in c-ares. A hostname with an     escaped trailing dot (such as 'hello\.') would have its     size calculated incorrectly, leading to a single byte     written beyond the end of a buffer on the heap. An     attacker able to provide such a hostname to an     application using c-ares, could potentially cause that     application to crash.(CVE-2016-5180)

  - The c-ares function `ares_parse_naptr_reply()`, which     is used for parsing NAPTR responses, could be triggered     to read memory outside of the given input buffer if the     passed in DNS response packet was crafted in a     particular way.(CVE-2017-1000381)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-28 (c-ares: Heap-based buffer overflow)

    A hostname with an escaped trailing dot (such as &ldquo;hello\\.&rdquo;) would       have its size calculated incorrectly leading to a single byte written       beyond the end of a buffer on the heap.
  Impact :

    A remote attacker, able to provide a specially crafted hostname to an       application using c-ares, could potentially cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

Security fix for CVE-2016-5180

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libcares2 fixes the following issues :

  - Add patch to fix single byte out of buffer write     (CVE-2016-5180, bsc#1007728)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libcares2 fixes the following issues :

  - ares_create_query() single byte out of buffer write     (CVE-2016-5180, boo#1007728)

This update for nodejs4 fixes the following issues :

Security issues fixed :

  - CVE-2016-5180: c-ares: Fix for single-byte buffer     overwrite (bsc#1007728).

Bug fixes :

  - bsc#1009011: npm4 should provide versioned nodejs-npm     and npm allowing nodejs-packaging to continue to     function properly in Leap 42.2

This update was imported from the SUSE:SLE-12:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
177842	Nessus Network Monitor < 6.2.2 多个漏洞 (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
210197	RHEL 6 / 7：rh-nodejs4-nodejs and rh-nodejs4-http-parser (RHSA-2017:0002)	Nessus	Red Hat Local Security Checks	2024/11/4	2024/11/5	critical
93836	Debian DSA-3682-1：c-ares - 安全性更新	Nessus	Debian Local Security Checks	2016/10/4	2021/1/11	critical
95428	Ubuntu 14.04 LTS / 16.04 LTS：c-ares 弱點 (USN-3143-1)	Nessus	Ubuntu Local Security Checks	2016/12/1	2024/8/27	critical
177842	Nessus Network Monitor < 6.2.2 多個弱點 (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
119986	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2016:2898-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
128953	EulerOS Virtualization for ARM 64 3.0.2.0 : c-ares (EulerOS-SA-2019-1950)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	critical
128097	EulerOS 2.0 SP5 : c-ares (EulerOS-SA-2019-1805)	Nessus	Huawei Local Security Checks	2019/8/23	2024/5/2	critical
96422	GLSA-201701-28 : c-ares: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	2017/1/12	2021/1/11	critical
93920	Fedora 23 : mingw-c-ares (2016-66d9389548)	Nessus	Fedora Local Security Checks	2016/10/10	2021/1/11	critical
96379	openSUSE Security Update : libcares2 (openSUSE-2017-58)	Nessus	SuSE Local Security Checks	2017/1/10	2021/1/19	critical
95463	openSUSE Security Update : libcares2 (openSUSE-2016-1373)	Nessus	SuSE Local Security Checks	2016/12/2	2021/1/19	critical
95557	openSUSE Security Update : nodejs4 (openSUSE-2016-1403)	Nessus	SuSE Local Security Checks	2016/12/6	2021/1/19	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical