远程主机正在运行的 macOS 版本为低于 10.12.4 的 10.12.x。因而多个组件会受到多个漏洞的影响，其中有些是远程代码执行漏洞。未经身份验证的远程攻击者可利用这些远程代码执行漏洞，诱使用户访问特制的网站，从而导致在当前用户环境中执行任意代码。受影响的组件为：- apache - apache_mod_php - AppleGraphicsPowerManagement - AppleRAID - Audio - Bluetooth - Carbon - CoreGraphics - CoreMedia - CoreText - curl - EFI - FinderKit - FontParser - HTTPProtocol - Hypervisor - iBooks - ImageIO - Intel Graphics Driver - IOATAFamily - IOFireWireAVC - IOFireWireFamily - Kernel - Keyboards - libarchive - libc++abi - LibreSSL - MCX Client - Menus - Multi-Touch - OpenSSH - OpenSSL - Printing - python - QuickTime - Security - SecurityFoundation - sudo - System Integrity Protection - tcpdump - tiffutil - WebKit

發現 libcurl 的 printf() 函式實作在進行大型浮點輸出時，會觸發緩衝區溢位。轉換大於 255 位元組的輸出時會發生此錯誤。會發生此缺陷是因為浮點轉換使用的系統函式缺少正確的邊界檢查所致。在缺少必要輸入篩選的情況下，如果有任何接受外部格式字串的應用程式，則可能會允許遠端攻擊。此缺陷不存在於命令列工具中。針對 Debian 7「Wheezy」，這些問題已在 7.26.0-1+wheezy18 版本中修正。建議您升級 curl 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

printf() 函式中 libcurl 的實作在進行大型浮點輸出時，會觸發緩衝區溢位。在缺少必要輸入篩選的情況下，如果有任何接受外部格式字串的應用程式，則可能會允許遠端攻擊。此缺陷不存在於命令列工具中。

遠端主機執行的 macOS 是 10.12.4 之前的 10.12.x 版。因此會受到多個元件中的多個弱點影響，其中有些是遠端程式碼執行弱點。未經驗證的遠端攻擊者可惡意利用這些遠端程式碼執行弱點，誘騙使用者造訪特製的網站，進而導致在目前使用者的內容中執行任意程式碼。受影響的元件如下：- apache - apache_mod_php - AppleGraphicsPowerManagement - AppleRAID - Audio - Bluetooth - Carbon - CoreGraphics - CoreMedia - CoreText - curl - EFI - FinderKit - FontParser - HTTPProtocol - Hypervisor - iBooks - ImageIO - Intel Graphics Driver - IOATAFamily - IOFireWireAVC - IOFireWireFamily - Kernel - Keyboards - libarchive - libc++abi - LibreSSL - MCX Client - Menus - Multi-Touch - OpenSSH - OpenSSL - Printing - python - QuickTime - Security - SecurityFoundation - sudo - System Integrity Protection - tcpdump - tiffutil - WebKit

遠端 Redhat Enterprise Linux 6 / 7 主機上安裝的套件受到 RHSA-2018:3558 公告中提及的多個弱點影響。

    Apache HTTP Server　是一款強大、有效且可延伸的網頁伺服器。httpd24 套件提供最新穩定的 Apache HTTP Server 2.4 版，外加 mod_auth_kerb 模組。

    下列套件已升級至更新的上游版本：httpd24-httpd (2.4.34)、httpd24-curl (7.61.1)。(BZ#1590833、BZ#1648928)

    安全性修正：

    * httpd：在 mod_session 中不當處理標頭可讓遠端使用者修改 CGI 應用程式的工作階段資料 (CVE-2018-1283)

    * httpd：mod_cache_socache 中的超出邊界讀取問題可讓遠端攻擊者造成拒絕服務 (CVE-2018-1303)

    * httpd：mod_http2: 配置給工作者過多時間，可能導致 DoS (CVE-2018-1333)

    * httpd：藉由傳送持續的 SETTINGS 造成 HTTP/2 連線 DoS (CVE-2018-11763)

    * httpd：在 mod_authnz_ldap 中使用太小的 Accept-Language 值時，就會發生超出邊界寫入 (CVE-2017-15710)

    * httpd：<FilesMatch> 在檔案名稱中發生結尾新行繞過 (CVE-2017-15715)

    * httpd：讀取 HTTP 要求失敗後造成越界存取 (CVE-2018-1301)

    * httpd：在 mod_auth_digest 中產生弱式摘要驗證 nonce (CVE-2018-1312)

    * curl：已修正 httpd24-curl 中的多個安全性問題 (CVE-2016-5419、CVE-2016-5420、CVE-2016-5421、CVE-2016-7141、CVE-2016-7167、CVE-2016-8615、CVE-2016-8616、CVE-2016-8617、CVE-2016-8618、CVE-2016-8619、CVE-2016-8620、CVE-2016-8621、CVE-2016-8622、CVE-2016-8623、CVE-2016-8624、CVE-2016-8625、CVE-2016-9586、CVE-2017-1000100、CVE-2017-1000101、CVE-2017-1000254、CVE-2017-1000257、CVE-2017-7407、CVE-2017-8816、CVE-2017-8817、CVE-2018-1000007、CVE-2018-1000120、CVE-2018-1000121、CVE-2018-1000122、CVE-2018-1000301、CVE-2018-14618)

    如需安全性問題的詳細資料，包括影響、CVSS 分數及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

    Red Hat 要感謝 Curl 專案報告 CVE-2017-8816、CVE-2017-8817、CVE-2017-1000254、CVE-2017-1000257、CVE-2018-1000007、CVE-2018-1000120、CVE-2018-1000122、CVE-2018-1000301、CVE-2016-9586、CVE-2017-1000100、CVE-2017-1000101、CVE-2018-14618 和 CVE-2018-1000121。上游確認 Alex Nichols 為 CVE-2017-8816 的原始報告者；OSS-Fuzz 專案為 CVE-2017-8817 和 CVE-2018-1000301 的原始報告者；Max Dymond 為 CVE-2017-1000254 和 CVE-2018-1000122 的原始報告者；Brian Carpenter 和 OSS-Fuzz 專案為 CVE-2017-1000257 的原始報告者；
    Craig de Stigter 為 CVE-2018-1000007 的原始報告者；Duy Phan Thanh 為 CVE-2018-1000120 的原始報告者；Even Rouault 為 CVE-2017-1000100 的原始報告者；Brian Carpenter 為 CVE-2017-1000101 的原始報告者；Zhaoyang Wu 為 CVE-2018-14618 的原始報告者；以及 Dario Weisser 為 CVE-2018-1000121 的原始報告者。

    錯誤修正：

    * 之前，httpd24 軟體集合中的 Apache HTTP Server 無法處理在瀏覽器中透過重新整理頁面重複要求靜態內容的情況。因此，HTTP/2 連線會逾時，且 httpd 會變得沒有回應。此錯誤已修正，HTTP/2 連線現可在所述狀況下正常運作。(BZ#1518737)

    增強功能：

    * 此更新將 mod_md 模組新增至 httpd24 軟體集合。此模組可使用自動憑證管理環境 (ACME) 通訊協定跨虛擬主機和憑證佈建管理網域。mod_md 模組僅適用於 Red Hat Enterprise Linux 7。
    (BZ#1640722)

    其他變更：

    如需有關此發行版本的詳細變更資訊，請參閱「參照」一節連結的 Red Hat Software Collections 3.2 版本資訊。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote host is running a version of Mac OS X version 10.x prior to 10.12.6, and is affected by multiple vulnerabilities :

 - An overflow condition exists in the curl component in the 'dprintf_formatf()' function that is triggered when handling floating point conversion. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-9586)
 - A flaw exits in the curl component in the 'randit()' function within file lib/rand.c due to improper initialization of the 32-bit random value, which is used, for example, to generate Digest and NTLM authentication nonces, resulting in weaker cryptographic operations than expected. (CVE-2016-9594)
 - A flaw exists in the curl component in the 'allocate_conn()' function in lib/url.c when using the OCSP stapling feature for checking a X.509 certificate revocation status. The issue is triggered as the request option for OCSP stapling is not properly passed to the TLS library, resulting in no error being returned even when no proof of the validity of the certificate could be provided. A man-in-the-middle attacker can exploit this to provide a revoked certificate. (CVE-2017-2629)
 - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)
 - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7009)
 - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013)
 - Multiple memory corruption issues exist in the Intel Graphics Driver component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with elevated privileges. (CVE-2017-7014, CVE-2017-7017, CVE-2017-7035, CVE-2017-7044)
 - A remote code execution vulnerability exists in the Audio component due to improper validation of user-supplied input when handling audio files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted audio file, to execute arbitrary code. (CVE-2017-7015)
 - Multiple remote code execution vulnerabilities exist in the afclip component due to improper validation of user-supplied input when handling audio files. An unauthenticated, remote attacker can exploit these vulnerabilities, by convincing a user to play a specially crafted audio file, to execute arbitrary code. (CVE-2017-7016, CVE-2017-7033)
 - A memory corruption issue exists in the AppleGraphicsPowerManagement component due to improper validation of input. A local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7021)
 - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)
 - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)
 - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory contents. (CVE-2017-7028, CVE-2017-7029, CVE-2017-7067)
 - A flaw exists in the Foundation component due to improper validation of input. A unauthenticated, remote attacker can exploit this, by convincing a user to open specially crafted file, to execute arbitrary code. (CVE-2017-7031)
 - A memory corruption issue exists in the 'kext tools' component due to improper validation of input. A local attacker can exploit this to execute arbitrary code with elevated privileges. (CVE-2017-7032)
 - Multiple unspecified flaws exist in the Intel Graphics Driver component due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory contents. (CVE-2017-7036, CVE-2017-7045)
 - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7047)
 - Multiple memory corruption issues exist in the Bluetooth component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with system privileges. (CVE-2017-7050, CVE-2017-7051)
 - A memory corruption issue exists in the Bluetooth component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with system privileges. (CVE-2017-7054)
 - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)
 - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)
 - A certificate validation bypass vulnerability exists in the curl component due to the program attempting to resume TLS sessions even if the client certificate fails. An unauthenticated, remote attacker can exploit this to bypass validation mechanisms. (CVE-2017-7468)
 - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)


ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2019/11/13	critical
96183	Debian DLA-767-1：curl 安全性更新	Nessus	Debian Local Security Checks	2017/1/3	2021/1/11	high
97896	Amazon Linux AMI：curl (ALAS-2017-806)	Nessus	Amazon Linux Local Security Checks	2017/3/23	2018/8/31	high
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2019/11/13	critical
194113	RHEL 6 / 7：httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/3/16	critical
700170	Mac OS X 10.x < 10.12.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2017/7/27	2019/3/6	critical

检测

插件搜索

critical

high

high

critical

critical

critical