The version of IBM HTTP Server running on the remote host is affected by a vulnerability related to Apache HTTP Server.
The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in apache (ASF HTTPD) :

XML parsing code in mod_dav incorrectly calculates the end of the string when removing leading spaces and places a NUL character outside the buffer, causing random crashes. This XML parsing code is only used with DAV provider modules that support DeltaV, of which the only publicly released provider is mod_dav_svn (CVE-2013-6438).

A flaw was found in mod_log_config. A remote attacker could send a specific truncated cookie causing a crash. This crash would only be a denial of service if using a threaded MPM (CVE-2014-0098).

The updated packages have been upgraded to the latest 2.2.27 version which is not vulnerable to these issues.

It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2013-6438)

A buffer over-read flaw was found in the httpd mod_log_config module.
In configurations where cookie logging is enabled (on Scientific Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098)

After installing the updated packages, the httpd daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201408-12 (Apache HTTP Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Apache HTTP Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted request to possibly       execute arbitrary code, cause Denial of Service, or obtain sensitive       information.
  Workaround :

    There is no known workaround at this time.

It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2013-6438)

A buffer over-read flaw was found in the httpd mod_log_config module.
In configurations where cookie logging is enabled, a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098)

The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components :

  - 802.1X
  - AFP File Server
  - apache
  - App Sandbox
  - Bash
  - Bluetooth
  - Certificate Trust Policy
  - CFPreferences
  - CoreStorage
  - CUPS
  - Dock
  - fdesetup
  - iCloud Find My Mac
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - LaunchServices
  - LoginWindow
  - Mail
  - MCX Desktop Config Profiles
  - NetFS Client Framework
  - QuickTime
  - Safari
  - Secure Transport
  - Security
  - Security - Code Signing

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Updated apache packages fix security vulnerabilities :

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when logging cookies (CVE-2014-0098).

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the apache user (CVE-2014-0226).

A denial of service flaw was found in the mod_proxy httpd module. A remote attacker could send a specially crafted request to a server configured as a reverse proxy using a threaded Multi-Processing Modules (MPM) that would cause the httpd child process to crash (CVE-2014-0117).

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the DEFLATE input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system (CVE-2014-0118).

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely (CVE-2014-0231).

A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled (CVE-2014-3581).

mod_lua.c in the mod_lua module in the Apache HTTP Server through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory (CVE-2014-8109).

In the mod_lua module in the Apache HTTP Server through 2.4.10, a maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash (CVE-2015-0228).

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers (CVE-2013-5704).

Note: With this update, httpd has been modified to not merge HTTP Trailer headers with other HTTP request headers. A newly introduced configuration directive MergeTrailers can be used to re-enable the old method of processing Trailer headers, which also re-introduces the aforementioned flaw.

This update also fixes the following bug :

Prior to this update, the mod_proxy_wstunnel module failed to set up an SSL connection when configured to use a back end server using the wss: URL scheme, causing proxied connections to fail. In these updated packages, SSL is used when proxying to wss: back end servers (rhbz#1141950).

IBM WebSphere Application Server 8.5 prior to Fix Pack 8.5.5.2 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities :

  - Numerous errors exist related to the included IBM SDK     for Java (based on the Oracle JDK) that could allow     denial of service attacks and information disclosure.
    (CVE-2013-5372, CVE-2013-5780, CVE-2013-5803)

  - User input validation errors exist related to the     Administrative console and the Oauth component that     could allow cross-site scripting attacks.
    (CVE-2013-6725 / PM98132, CVE-2013-6323 / PI04777,     CVE-2013-6738 / PI05661)

  - An error exists due to a failure to properly     handle by web services endpoint requests that     could allow denial of service attacks.
    (CVE-2013-6325 / PM99450, PI08267)

  - An error exists in the included IBM Global Security     Kit related to SSL handling that could allow denial     of service attacks. (CVE-2013-6329 / PI05309)

  - A flaw exists with the 'mod_dav' module that is caused     when tracking the length of CDATA that has leading     white space. A remote attacker with a specially crafted     DAV WRITE request can cause the service to stop     responding. (CVE-2013-6438 / PI09345)

  - An error exists in the included IBM Global Security     Kit related to malformed X.509 certificate chain     handling that could allow denial of service attacks.
    (CVE-2013-6747 / PI09443)

  - An error exists in the included Apache Tomcat version     related to handling 'Content-Type' HTTP headers and     multipart requests such as file uploads that could     allow denial of service attacks. (CVE-2014-0050 /     PI12648, PI12926)

  - An unspecified error exists that could allow file     disclosures to remote unauthenticated attackers.
    (CVE-2014-0823 / PI05324)

  - An unspecified error exists related to the     Administrative console that could allow a security     bypass. (CVE-2014-0857 / PI07808)

  - An error exists related to a web server plugin and     retrying failed POST requests that could allow denial     of service attacks. (CVE-2014-0859 / PI08892)

  - An error exists related to the Proxy and ODR components     that could allow information disclosure. (CVE-2014-0891     / PI09786)

  - An unspecified error exists related to the 'Liberty     Profile' that could allow information disclosure.
    (CVE-2014-0896 / PI10134)

According to its banner, the version of Apache 2.4.x running on the remote host is a version prior to 2.4.8. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists with the 'mod_dav' module that is caused     when tracking the length of CDATA that has leading white     space. A remote attacker with a specially crafted DAV     WRITE request can cause the service to stop responding.
    (CVE-2013-6438)

  - A flaw exists in 'mod_log_config' module that is caused     when logging a cookie that has an unassigned value. A     remote attacker with a specially crafted request can     cause the service to crash. (CVE-2014-0098)

Note that Nessus did not actually test for these issues, but instead has relied on the version in the server's banner.

New httpd packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0370 advisory.

    - mod_dav: add security fix for CVE-2013-6438 (#1078174)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2013-6438)

A buffer over-read flaw was found in the httpd mod_log_config module.
In configurations where cookie logging is enabled (on Red Hat Enterprise Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098)

All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

According to its self-reported version number, the version of Junos Space running on the remote device is prior to 15.1R1. It is, therefore, affected by multiple vulnerabilities :

  - An error exists within the Apache 'mod_session_dbd'     module, related to save operations for a session, due to     a failure to consider the dirty flag and to require a     new session ID. An unauthenticated, remote attacker can     exploit this to have an unspecified impact.
    (CVE-2013-2249)

  - An unspecified flaw exists in the MySQL Server component     related to error handling that allows a remote attacker     to cause a denial of service condition. (CVE-2013-5908)

  - A flaw exists within the Apache 'mod_dav' module that is     caused when tracking the length of CDATA that has     leading white space. An unauthenticated, remote attacker     can exploit this, via a specially crafted DAV WRITE     request, to cause the service to stop responding.
    (CVE-2013-6438)

  - A flaw exists within the Apache 'mod_log_config' module     that is caused when logging a cookie that has an     unassigned value. An unauthenticated, remote attacker     can exploit this, via a specially crafted request, to     cause the service to crash. (CVE-2014-0098)

  - A flaw exists, related to pixel manipulation, in the     2D component in the Oracle Java runtime that allows an     unauthenticated, remote attacker to impact availability,     confidentiality, and integrity. (CVE-2014-0429)

  - A flaw exists, related to PKCS#1 unpadding, in the     Security component in the Oracle Java runtime that     allows an unauthenticated, remote attacker to gain     knowledge of timing information, which is intended to     be protected by encryption. (CVE-2014-0453)

  - A race condition exists, related to array copying, in     the Hotspot component in the Oracle Java runtime that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2014-0456)

  - A flaw exists in the JNDI component in the Oracle Java     runtime due to missing randomization of query IDs. An     unauthenticated, remote attacker can exploit this to     conduct spoofing attacks. (CVE-2014-0460)

  - A flaw exists in the Mozilla Network Security Services     (NSS) library, which is due to lenient parsing of ASN.1     values involved in a signature and can lead to the     forgery of RSA signatures, such as SSL certificates.
    (CVE-2014-1568)

  - An unspecified flaw exists in the MySQL Server component     related to the CLIENT:SSL:yaSSL subcomponent that allows     a remote attacker to impact integrity. (CVE-2014-6478)

  - Multiple unspecified flaws exist in the MySQL Server     component related to the SERVER:SSL:yaSSL subcomponent     that allow a remote attacker to impact confidentiality,     integrity, and availability. (CVE-2014-6491,     CVE-2014-6500)

  - Multiple unspecified flaws exist in the MySQL Server     component related to the CLIENT:SSL:yaSSL subcomponent     that allow a remote attacker to cause a denial of     service condition. (CVE-2014-6494, CVE-2014-6495,     CVE-2014-6496)

  - An unspecified flaw exists in the MySQL Server component     related to the C API SSL Certificate Handling     subcomponent that allows a remote attacker to disclose     potentially sensitive information. (CVE-2014-6559)

  - An unspecified flaw exists in the MySQL Server component     related to the Server:Compiling subcomponent that allows     an authenticated, remote attacker to cause a denial of     service condition. (CVE-2015-0501)

  - An XML external entity (XXE) injection vulnerability     exists in OpenNMS due to the Castor component accepting     XML external entities from exception messages. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data in a RTC post, to access     local files. (CVE-2015-0975)

  - An unspecified flaw exists in the MySQL Server component     related to the Server:Security:Privileges subcomponent     that allows a remote attacker to disclose potentially     sensitive information. (CVE-2015-2620)

  - A heap buffer overflow condition exists in QEMU in the     pcnet_transmit() function within file hw/net/pcnet.c     due to improper validation of user-supplied input when     handling multi-TMD packets with a length above 4096     bytes. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to gain elevated     privileges from guest to host. (CVE-2015-3209)

  - Multiple cross-site scripting (XSS), SQL injection, and     command injection vulnerabilities exist in Junos Space     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2015-7753)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
144291	IBM HTTP Server 7.0.0.0 < 7.0.0.33 / 8.0.0.0 < 8.0.0.9 / 8.5.0.0 < 8.5.5.2 Buffer Overflow (244199)	Nessus	Web Servers	2020/12/15	2022/4/11	medium
73128	Mandriva Linux Security Advisory : apache (MDVSA-2014:065)	Nessus	Mandriva Local Security Checks	2014/3/21	2021/1/6	medium
73368	Scientific Linux Security Update : httpd on SL5.x i386/x86_64 (20140403)	Nessus	Scientific Linux Local Security Checks	2014/4/7	2021/1/14	medium
77456	GLSA-201408-12 : Apache HTTP Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/8/30	2021/1/6	medium
78274	Amazon Linux AMI : httpd (ALAS-2014-331)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
78550	Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock)	Nessus	MacOS X Local Security Checks	2014/10/17	2024/5/28	critical
82346	Mandriva Linux Security Advisory : apache (MDVSA-2015:093)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
74235	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.2 Multiple Vulnerabilities	Nessus	Web Servers	2014/5/29	2019/11/26	high
73081	Apache 2.4.x < 2.4.8 Multiple Vulnerabilities	Nessus	Web Servers	2014/3/18	2022/4/11	medium
73248	Slackware 14.0 / 14.1 / current : httpd (SSA:2014-086-02)	Nessus	Slackware Local Security Checks	2014/3/31	2021/1/14	medium
73324	Oracle Linux 6 : httpd (ELSA-2014-0370)	Nessus	Oracle Linux Local Security Checks	2014/4/4	2024/10/22	high
73326	RHEL 6 : httpd (RHSA-2014:0370)	Nessus	Red Hat Local Security Checks	2014/4/4	2021/1/14	medium
91778	Juniper Junos Space < 15.1R1 Multiple Vulnerabilities (JSA10698)	Nessus	Junos Local Security Checks	2016/6/23	2018/7/12	critical
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical

检测

插件搜索

medium

medium

medium

medium

medium

critical

medium

high

medium

medium

high

medium

critical

critical