According to its self-reported version number, the remote Junos Space version is prior to 13.1R1.6. It is, therefore, affected by the following vulnerabilities :

  - Multiple Vulnerabilities related to the included Apache     HTTP server. (CVE-2011-3368, CVE-2011-4317,     CVE-2012-0053)

  - A cross-site scripting flaw within the web interface     that allows a remote attacker, with a specially crafted     request, to access sensitive information.
    (CVE-2013-5095)

  - A flaw exists with the access control implementation     that allows a remote attacker with read-only privileges     to change the device's configuration. (CVE-2013-5096)

  - An information disclosure flaw exists that allows a     remote attacker to obtain a list of users and their     hashed passwords. (CVE-2013-5097)

The remote Solaris system is missing necessary patches to address security updates :

  - Integer overflow in the ap_pregsub function in     server/util.c in the Apache HTTP Server 2.0.x through     2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif     module is enabled, allows local users to gain privileges     via a .htaccess file with a crafted SetEnvIf directive,     in conjunction with a crafted HTTP request header,     leading to a heap-based buffer overflow. (CVE-2011-3607)

  - The mod_proxy module in the Apache HTTP Server 2.0.x     through 2.0.64, and 2.2.x through 2.2.21, when the     Revision 1179239 patch is in place, does not properly     interact with use of (1) RewriteRule and (2)     ProxyPassMatch pattern matches for configuration of a     reverse proxy, which allows remote attackers to send     requests to intranet servers via a malformed URI     containing an @ (at sign) character and a : (colon)     character in invalid positions. NOTE: this vulnerability     exists because of an incomplete fix for CVE-2011-3368.
    (CVE-2011-4317)

  - scoreboard.c in the Apache HTTP Server 2.2.21 and     earlier might allow local users to cause a denial of     service (daemon crash during shutdown) or possibly have     unspecified other impact by modifying a certain type     field within a scoreboard shared memory segment, leading     to an invalid call to the free function. (CVE-2012-0031)

  - protocol.c in the Apache HTTP Server 2.2.x through     2.2.21 does not properly restrict header information     during construction of Bad Request (aka 400) error     documents, which allows remote attackers to obtain the     values of HTTPOnly cookies via vectors involving a (1)     long or (2) malformed header in conjunction with crafted     web script. (CVE-2012-0053)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-205:03 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server.
    Security issues fixed with this release:
    CVE-2011-3607     Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through     2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain     privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP     request header, leading to a heap-based buffer overflow.
    CVE-2011-3639     The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the     Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2)     ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send     requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @     (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
    CVE-2011-4317     The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x     through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1)     RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows     remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign)     character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2011-3368.
    CVE-2012-0031     scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of     service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain     type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
    CVE-2012-0053     protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information     during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the     values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with     crafted web script.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released via RHSA-2011:1391) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request, or by using a specially crafted URI.
(CVE-2011-3639, CVE-2011-4317)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

This update fixes the following issues :

  - Denial of Service via special requests in mod_proxy_ajp.
    (CVE-2012-4557)

  - improper LD_LIBRARY_PATH handling. (CVE-2012-0883)

  - filename escaping problem Additionally, some     non-security bugs have been fixed:. (CVE-2012-2687)

  - ignore case when checking against SNI server names.
    [bnc#798733]

  - httpd-2.2.x-CVE-2011-3368_CVE-2011-4317-bnc722545.diff     reworked to reflect the upstream changes. This will     prevent the 'Invalid URI in request OPTIONS *' messages     in the error log. [bnc#722545]

  - new sysconfig variable APACHE_DISABLE_SSL_COMPRESSION;
    if set to on, OPENSSL_NO_DEFAULT_ZLIB will be inherited     to the apache process; openssl will then transparently     disable compression. This change affects start script     and sysconfig fillup template. Default is on, SSL     compression disabled. Please see mod_deflate for     compressed transfer at http layer. [bnc#782956]

This update fixes several security issues in the Apache2 webserver.

CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives.

CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges

In addition to that the following changes were made :

  - new template file:
    /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1     only, browser match stuff commented out.

  - rc script /etc/init.d/apache2: handle reload with     deleted binaries by message to stdout only, but refrain     from sending signals.

- httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make non-ascii eg UTF8 passwords work with mod_authnz_ldap.
[bnc#727071]

According to its banner, the version of Apache 2.2.x installed on the remote host is prior to 2.2.22. It is, therefore, potentially affected by the following vulnerabilities :

  - When configured as a reverse proxy, improper use of the     RewriteRule and ProxyPassMatch directives could cause     the web server to proxy requests to arbitrary hosts.
    This could allow a remote attacker to indirectly send     requests to intranet servers.
    (CVE-2011-3368, CVE-2011-4317)

  - A heap-based buffer overflow exists when mod_setenvif     module is enabled and both a maliciously crafted     'SetEnvIf' directive and a maliciously crafted HTTP     request header are used. (CVE-2011-3607)

  - A format string handling error can allow the server to     be crashed via maliciously crafted cookies.
    (CVE-2012-0021)

  - An error exists in 'scoreboard.c' that can allow local     attackers to crash the server during shutdown.
    (CVE-2012-0031)

  - An error exists in 'protocol.c' that can allow     'HTTPOnly' cookies to be exposed to attackers through     the malicious use of either long or malformed HTTP     headers. (CVE-2012-0053)

  - An error in the mod_proxy_ajp module when used to     connect to a backend server that takes an overly long     time to respond could lead to a temporary denial of     service. (CVE-2012-4557)

Note that Nessus did not actually test for these flaws, but instead has relied on the version in the server's banner.

The version of Apache HTTP Server running on the remote host is affected by an information disclosure vulnerability. When configured as a reverse proxy, improper use of the RewriteRule and ProxyPassMatch directives could cause the web server to proxy requests to arbitrary hosts. This allows a remote attacker to indirectly send requests to intranet servers.

Multiple vulnerabilities has been found and corrected in apache :

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow (CVE-2011-3607).

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an \@ (at sign) character and a : (colon) character in invalid positions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368 (CVE-2011-4317).

The updated packages have been patched to correct these issues.

Several vulnerabilities have been found in the Apache HTTPD Server :

  - CVE-2011-3607 :
    An integer overflow in ap_pregsub() could allow local     attackers to execute arbitrary code at elevated     privileges via crafted .htaccess files.

  - CVE-2011-3368 CVE-2011-3639 CVE-2011-4317 :
    The Apache HTTP Server did not properly validate the     request URI for proxied requests. In certain reverse     proxy configurations using the ProxyPassMatch directive     or using the RewriteRule directive with the [P] flag, a     remote attacker could make the proxy connect to an     arbitrary server. This could allow the attacker to     access internal servers that are not otherwise     accessible from the outside.

  The three CVE ids denote slightly different variants of the same   issue.

  Note that, even with this issue fixed, it is the responsibility of   the administrator to ensure that the regular expression replacement   pattern for the target URI does not allow a client to append   arbitrary strings to the host or port parts of the target URI. For   example, the configuration

  ProxyPassMatch ^/mail(.*) http://internal-host$1

  is still insecure and should be replaced by one of the following   configurations :

  ProxyPassMatch ^/mail(/.*) http://internal-host$1 ProxyPassMatch   ^/mail/(.*) http://internal-host/$1

  - CVE-2012-0031 :
    An apache2 child process could cause the parent process     to crash during shutdown. This is a violation of the     privilege separation between the apache2 processes and     could potentially be used to worsen the impact of other     vulnerabilities.

  - CVE-2012-0053 :
    The response message for error code 400 (bad request)     could be used to expose 'httpOnly' cookies. This could     allow a remote attacker using cross site scripting to     steal authentication cookies.

This update contains the latest stable release of the Apace HTTP Server, version 2.2.22. This release fixes various bugs, and the following security issues :

  - Reject requests where the request-URI does not match the     HTTP specification, preventing unexpected expansion of     target URLs in some reverse proxy configurations.
    (CVE-2011-3368)

  - Fix integer overflow in ap_pregsub() which, when the     mod_setenvif module is enabled, could allow local users     to gain privileges via a .htaccess file. (CVE-2011-3607)

  - Resolve additional cases of URL rewriting with     ProxyPassMatch or RewriteRule, where particular     request-URIs could result in undesired backend network     exposure in some configurations. (CVE-2011-4317)

  - mod_log_config: Fix segfault (crash) when the     '%{cookiename}C' log format string is in use and a     client sends a nameless, valueless cookie, causing a     denial of service. The issue existed since version     2.2.17. (CVE-2012-0021)

  - Fix scoreboard issue which could allow an unprivileged     child process could cause the parent to crash at     shutdown rather than terminate cleanly. (CVE-2012-0031)

  - Fixed an issue in error responses that could expose     'httpOnly' cookies when no custom ErrorDocument is     specified for status code 400. (CVE-2012-0053)

http://www.apache.org/dist/httpd/CHANGES_2.2.22

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

Also a non-security bug was fixed :

  - httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make     non-ascii eg UTF8 passwords work with mod_authnz_ldap.
    [bnc#727071]

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80192	Juniper Junos Space 11.1x < 13.1R1.6 Multiple Vulnerabilities (JSA10585)	Nessus	Junos Local Security Checks	2014/12/22	2018/7/12	medium
80582	Oracle Solaris Third-Party Patch Update : apache (cve_2011_3607_buffer_overflow)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
291515	MiracleLinux 4 : httpd-2.2.15-15.1.0.1.AXS4 (AXSA:2012-205:03)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	medium
57960	CentOS 6 : httpd (CESA-2012:0128)	Nessus	CentOS Local Security Checks	2012/2/16	2021/1/4	medium
65023	SuSE 11.2 Security Update : Apache (SAT Patch Number 7409)	Nessus	SuSE Local Security Checks	2013/3/5	2021/1/19	medium
75427	openSUSE Security Update : apache2 (openSUSE-SU-2012:0248-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
57791	Apache 2.2.x < 2.2.22 Multiple Vulnerabilities	Nessus	Web Servers	2012/2/2	2018/6/29	medium
56972	Apache HTTP Server mod_proxy Reverse Proxy Information Disclosure	Nessus	Web Servers	2011/11/29	2018/6/27	medium
57480	Mandriva Linux Security Advisory : apache (MDVSA-2012:003)	Nessus	Mandriva Local Security Checks	2012/1/11	2021/1/6	medium
57851	Debian DSA-2405-1 : apache2 - multiple issues	Nessus	Debian Local Security Checks	2012/2/7	2021/1/11	medium
58252	Fedora 15 : httpd-2.2.22-1.fc15 (2012-1642)	Nessus	Fedora Local Security Checks	2012/3/7	2021/1/11	medium
57090	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5482)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium