This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0128 advisory.

    The Apache HTTP Server is a popular web server.

    It was discovered that the fix for CVE-2011-3368 (released via     RHSA-2011:1391) did not completely address the problem. An attacker could     bypass the fix and make a reverse proxy connect to an arbitrary server not     directly accessible to the attacker by sending an HTTP version 0.9 request,     or by using a specially-crafted URI. (CVE-2011-3639, CVE-2011-4317)

    The httpd server included the full HTTP header line in the default error     page generated when receiving an excessively long or malformed header.
    Malicious JavaScript running in the server's domain context could use this     flaw to gain access to httpOnly cookies. (CVE-2012-0053)

    An integer overflow flaw, leading to a heap-based buffer overflow, was     found in the way httpd performed substitutions in regular expressions. An     attacker able to set certain httpd settings, such as a user permitted to     override the httpd configuration for a specific directory using a     .htaccess file, could use this flaw to crash the httpd child process or,     possibly, execute arbitrary code with the privileges of the apache user.
    (CVE-2011-3607)

    A flaw was found in the way httpd handled child process status information.
    A malicious program running with httpd child process privileges (such as a     PHP or CGI script) could use this flaw to cause the parent httpd process to     crash during httpd service shutdown. (CVE-2012-0031)

    All httpd users should upgrade to these updated packages, which contain     backported patches to correct these issues. After installing the updated     packages, the httpd daemon will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Apache HTTP Server is a popular web server.

It was discovered that the fix for CVE-2011-3368 (released in a previous update) did not completely address the problem. An attacker could bypass the fix and make a reverse proxy connect to an arbitrary server not directly accessible to the attacker by sending an HTTP version 0.9 request, or by using a specially crafted URI.
(CVE-2011-3639, CVE-2011-4317)

The httpd server included the full HTTP header line in the default error page generated when receiving an excessively long or malformed header. Malicious JavaScript running in the server's domain context could use this flaw to gain access to httpOnly cookies.
(CVE-2012-0053)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way httpd performed substitutions in regular expressions.
An attacker able to set certain httpd settings, such as a user permitted to override the httpd configuration for a specific directory using a '.htaccess' file, could use this flaw to crash the httpd child process or, possibly, execute arbitrary code with the privileges of the 'apache' user. (CVE-2011-3607)

A flaw was found in the way httpd handled child process status information. A malicious program running with httpd child process privileges (such as a PHP or CGI script) could use this flaw to cause the parent httpd process to crash during httpd service shutdown.
(CVE-2012-0031)

All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0128 advisory.

    - add security fixes for CVE-2011-4317, CVE-2012-0053, CVE-2012-0031,       CVE-2011-3607 (#787598)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201206-25 (Apache HTTP Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTP Server.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might obtain sensitive information, gain privileges,       send requests to unintended servers behind proxies, bypass certain       security restrictions, obtain the values of HTTPOnly cookies, or cause a       Denial of Service in various ways.
    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

CVE MITRE reports :

An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

A flaw was found in mod_log_config. If the '%{cookiename}C' log format string is in use, a remote attacker could send a specific cookie causing a crash. This crash would only be a denial of service if using a threaded MPM.

A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.

A flaw was found in the default error response for status code 400.
This flaw could be used by an attacker to expose 'httpOnly' cookies when no custom ErrorDocument is specified.

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. The apr-util package has also been updated to the latest version.

This update fixes several security issues in the Apache2 webserver.

CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives.

CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges

In addition to that the following changes were made :

  - new template file:
    /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1     only, browser match stuff commented out.

  - rc script /etc/init.d/apache2: handle reload with     deleted binaries by message to stdout only, but refrain     from sending signals.

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
57298	SuSE 10 Security Update : Apache2 (ZYPP Patch Number 7882)	Nessus	SuSE Local Security Checks	2011/12/14	2021/1/19	medium
57931	RHEL 6 : httpd (RHSA-2012:0128)	Nessus	Red Hat Local Security Checks	2012/2/14	2025/4/15	medium
61245	Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20120213)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
68458	Oracle Linux 6 : httpd (ELSA-2012-0128)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	medium
59678	GLSA-201206-25 : Apache HTTP Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	high
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	2012/9/20	2024/5/28	critical
57786	FreeBSD : apache -- multiple vulnerabilities (4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0)	Nessus	FreeBSD Local Security Checks	2012/2/2	2021/1/6	medium
57892	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : httpd (SSA:2012-041-01)	Nessus	Slackware Local Security Checks	2012/2/13	2021/1/14	medium
75788	openSUSE Security Update : apache2 (openSUSE-SU-2012:0212-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
79733	F5 Networks BIG-IP : Apache HTTP server vulnerabilities (SOL15889)	Nessus	F5 Networks Local Security Checks	2014/12/5	2021/3/10	medium

检测

插件搜索

medium

medium

medium

medium

high

critical

medium

medium

medium

medium