The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities in the Web Listener subcomponent :

  - An integer overflow condition exists in libxml2 within     file xpath.c, related to XPath expressions when adding a     new namespace note. An unauthenticated, remote attacker     can exploit this, via a crafted XML file, to cause a     denial of service condition or the execution of arbitary     code. (CVE-2011-1944)

  - An integer overflow condition exists in the HTTP server,     specifically in the ap_pregsub() function within file     server/util.c, when the mod_setenvif module is enabled.
    A local attacker can exploit this to gain elevated     privileges by using an .htaccess file with a crafted     combination of SetEnvIf directives and HTTP request     headers. (CVE-2011-3607)

  - A flaw exists in libxml2, known as the 'internal entity     expansion' with linear complexity issue, that allows     specially crafted XML files to consume excessive CPU and     memory resources. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     by using a specially crafted XML file containing an     entity declaration with long replacement text and many     references to this entity. (CVE-2013-0338)

  - An out-of-bounds read error exists in libxml2 within     file parser.c due to a failure to check for the     XML_PARSER_EOF state. An unauthenticated, remote     attacker can exploit this, via a specially crafted     document that ends abruptly, to cause a denial of     service condition. (CVE-2013-2877)

  - A flaw exists within the mod_headers module in the     HTTP server which allows bypassing the 'RequestHeader     unset' directives. An unauthenticated, remote attacker     can exploit this to inject arbitrary headers. This is     done by placing a header in the trailer portion of data     being sent using chunked transfer encoding.
    (CVE-2013-5704)

  - A flaw exists in the dav_xml_get_cdata() function in     file main/util.c within the HTTP server mod_dav module     due to incorrect stripping of whitespace characters from     the CDATA sections. An unauthenticated, remote attacker     via a specially crafted DAV WRITE request, can exploit     this to cause a denial of service condition.
    (CVE-2013-6438)

  - A flaw exists in the log_cookie() function in file     mod_log_config.c within the HTTP server mod_log_config     module due to improper handling of specially crafted     cookies during truncation. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition via a segmentation fault. (CVE-2014-0098)

  - A flaw exists in libxml2, specifically in the     xmlParserHandlePEReference() function in file parser.c,     due to loading external parameter entities even when     entity substitution is disabled. An unauthenticated,     remote attacker can exploit this issue, via a specially     crafted XML file, to conduct XML External Entity (XXE)     attacks that exhaust CPU and memory resources, resulting     in a denial of service condition. (CVE-2014-0191)

  - A race condition exists in the HTTP server within the     mod_status module when using a threaded Multi-Processing     Module (MPM). If an unauthenticated, remote attacker is     able to access status pages served by mod_status, the     attacker can exploit this issue, by sending specially     crafted requests, to cause the httpd child process to     crash or possibly execute arbitrary code with the     privileges of the user running the web server.
    (CVE-2014-0226)

  - An unspecified flaw exists in the Web Listener     subcomponent that allows an unauthenticated, remote     attacker to impact confidentiality, integrity, and     availability. (CVE-2014-6571)

  - An unspecified flaw exists in the J2EE subcomponent that     allows an unauthenticated, remote attacker to disclose     potentially sensitive information. (CVE-2015-0372)

  - An unspecified flaw exists in the Web Listener     subcomponent that allows an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2015-0386)

Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing string substitution during entity expansion.

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - Multiple errors exist related to OpenSSL that could     allow information disclosure or denial of service     attacks. (CVE-2013-0166, CVE-2013-0169)

  - An error exists in the libxml2 library related to the     expansion of XML internal entities. An attacker can     exploit this to cause a denial of service. (CVE-2013-0338)

  - An unspecified error exists related to 'hostd-vmdb'. An     attacker can exploit this to cause a denial of service.
    (CVE-2013-5970)

  - An error exists in the handling of certain Virtual     Machine file descriptors. This may allow an unprivileged     user with the 'Add Existing Disk' privilege to obtain     read and write access to arbitrary files, possibly     leading to arbitrary code execution after a host reboot.
    (CVE-2013-5973)

  - A NULL pointer dereference flaw exists in the handling     of Network File Copy (NFC) traffic. This issue may lead     to a denial of service if an attacker intercepts and     modifies the NFC traffic. (CVE-2014-1207)

  - A denial of service vulnerability exists in the handling     of invalid ports that could allow a guest user to crash     the VMX process. (CVE-2014-1208)

The remote Solaris system is missing necessary patches to address security updates :

  - libxml2 2.9.0 and earlier allows context-dependent     attackers to cause a denial of service (CPU and memory     consumption) via an XML file containing an entity     declaration with long replacement text and many     references to this entity, aka 'internal entity     expansion' with linear complexity. (CVE-2013-0338)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
81002	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2015 CPU)	Nessus	Web Servers	2015/1/27	2024/6/19	high
65695	Debian DSA-2652-1 : libxml2 - external entity expansion	Nessus	Debian Local Security Checks	2013/3/27	2021/1/11	medium
70879	ESXi 5.0 < Build 1311175 Multiple Vulnerabilities (remote check)	Nessus	Misc.	2013/11/13	2022/12/5	medium
80690	Oracle Solaris Third-Party Patch Update : libxml2 (cve_2013_0338_denial_of)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium

检测

插件搜索

high

medium

medium

medium