Apache HTTP SERVER PROJECT reports :

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of service via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

core: HTTP trailers could be used to replace HTTP headers late during request processing, potentially undoing or otherwise confusing modules that examined or modified request headers earlier. Adds 'MergeTrailers' directive to restore legacy behavior.

This update includes the latest stable release of the Apache HTTP Server, httpd 2.4.10, fixing a number of security issues.

http://www.apache.org/dist/httpd/Announcement2.4.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1088 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of     components for hosting Java web applications. It is comprised of the Apache     HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector     (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat     Native library.

    This release serves as a replacement for Red Hat JBoss Web Server 2.0.1,     and includes several bug fixes. Refer to the Red Hat JBoss Web Server 2.1.0     Release Notes, linked to in the References section, for information on the     most significant of these changes.

    The following security issues are also fixed with this release:

    A race condition flaw, leading to heap-based buffer overflows, was found in     the mod_status httpd module. A remote attacker able to access a status page     served by mod_status on a server using a threaded Multi-Processing Module     (MPM) could send a specially crafted request that would cause the httpd     child process to crash or, possibly, allow the attacker to execute     arbitrary code with the privileges of the apache user. (CVE-2014-0226)

    A denial of service flaw was found in the way httpd's mod_deflate module     handled request body decompression (configured via the DEFLATE input     filter). A remote attacker able to send a request whose body would be     decompressed could use this flaw to consume an excessive amount of system     memory and CPU on the target system. (CVE-2014-0118)

    A denial of service flaw was found in the way httpd's mod_cgid module     executed CGI scripts that did not read data from the standard input.
    A remote attacker could submit a specially crafted request that would cause     the httpd child process to hang indefinitely. (CVE-2014-0231)

    It was found that several application-provided XML files, such as web.xml,     content.xml, *.tld, *.tagx, and *.jspx, resolved external entities,     permitting XML External Entity (XXE) attacks. An attacker able to deploy     malicious applications to Tomcat could use this flaw to circumvent security     restrictions set by the JSM, and gain access to sensitive information on     the system. Note that this flaw only affected deployments in which Tomcat     is running applications from untrusted sources, such as in a shared hosting     environment. (CVE-2013-4590)

    It was found that, in certain circumstances, it was possible for a     malicious web application to replace the XML parsers used by Tomcat to     process XSLTs for the default servlet, JSP documents, tag library     descriptors (TLDs), and tag plug-in configuration files. The injected XML     parser(s) could then bypass the limits imposed on XML external entities     and/or gain access to the XML files processed for other web applications     deployed on the same Tomcat instance. (CVE-2014-0119)

    All users of Red Hat JBoss Web Server 2.0.1 on Red Hat Enterprise Linux 5     are advised to upgrade to Red Hat JBoss Web Server 2.1.0. The JBoss server     process must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

Apache HTTP SERVER PROJECT reports : mod_proxy: Fix crash in Connection header handling which allowed a denial of service attack against a reverse proxy with a threaded MPM.

Fix a race condition in scoreboard handling, which could lead to a heap buffer overflow.

mod_deflate: The DEFLATE input filter (inflates request bodies) now limits the length and compression ratio of inflated request bodies to avoid denial of sevice via highly compressed bodies. See directives DeflateInflateLimitRequestBody, DeflateInflateRatioLimit, and DeflateInflateRatioBurst.

mod_cgid: Fix a denial of service against CGI scripts that do not consume stdin that could lead to lingering HTTPD child processes filling up the scoreboard and eventually hanging the server. By default, the client I/O timeout (Timeout directive) now applies to communication with scripts. The CGIDScriptTimeout directive can be used to set a different timeout for communication with scripts.

New httpd packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A NULL pointer dereference flaw was found in the mod_cache httpd module. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP Server was used as a forward proxy with caching. (CVE-2013-4352)

A denial of service flaw was found in the mod_proxy httpd module. A remote attacker could send a specially crafted request to a server configured as a reverse proxy using a threaded Multi-Processing Modules (MPM) that would cause the httpd child process to crash.
(CVE-2014-0117)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

The remote host is running a version of IBM WebSphere Application Server 7.0 prior to Fix Pack 35. It is, therefore, affected by the following vulnerabilities :

  - Multiple errors exist related to the included IBM HTTP     server that could allow remote code execution or denial     of service. (CVE-2013-5704, CVE-2014-0118,     CVE-2014-0226, CVE-2014-0231 / PI22070)

  - An error exists related to HTTP header handling that     could allow the disclosure of sensitive information.
    (CVE-2014-3021 / PI08268)

  - An unspecified error exists that could allow the     disclosure of sensitive information.
    (CVE-2014-3083 / PI17768)

  - An unspecified input-validation errors exist related to     the 'Admin Console' that could allow cross-site     scripting and cross-site request forgery attacks.
    (CVE-2014-4770, CVE-2014-4816 / PI23055)

CVE-2014-0231: prevent denial of service in mod_cgid.

CVE-2014-0226: prevent denial of service via race in mod_status.

CVE-2014-0118: fix resource consumption via mod_deflate body decompression.

CVE-2013-6438: prevent denial of service via mod_dav incorrect end of string

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of NSM (Network and Security Manager) Server that is prior to 2012.2R9. It is, therefore, affected by multiple vulnerabilities in the bundled version of Apache HTTP Server :

  - A flaw exists due to improper escaping of filenames in     406 and 300 HTTP responses. A remote attacker can     exploit this, by uploading a file with a specially     crafted name, to inject arbitrary HTTP headers or     conduct cross-site scripting attacks. (CVE-2008-0456)

  - Multiple cross-site scripting vulnerabilities exist in     the mod_negotiation module due to improper sanitization     of input passed via filenames. An attacker can exploit     this to execute arbitrary script code in a user's     browser. (CVE-2012-2687)

  - Multiple cross-site scripting vulnerabilities exist in     the mod_info, mod_status, mod_imagemap, mod_ldap, and     mod_proxy_ftp modules due to improper validation of     input passed via the URL or hostnames. An attacker can     exploit this to execute arbitrary script code in a     user's browser. (CVE-2012-3499)

  - A cross-site scripting vulnerability exists in the     mod_proxy_balancer module due to improper validation of     input passed via the URL or hostnames. An attacker can     exploit this to execute arbitrary script code in a     user's browser. (CVE-2012-4558)

  - A flaw exists in the do_rewritelog() function due to     improper sanitization of escape sequences written to log     files. A remote attacker can exploit this, via a     specially crafted HTTP request, to execute arbitrary     commands. (CVE-2013-1862)

  - A denial of service vulnerability exists in mod_dav.c     due to improper validation to determine if DAV is     enabled for a URI. A remote attacker can exploit this,     via a specially crafted MERGE request, to cause a     segmentation fault, resulting in a denial of service     condition. (CVE-2013-1896)

  - A denial of service vulnerability exists in the     dav_xml_get_cdata() function     due to improper removal of whitespace characters from     CDATA sections. A remote attacker can exploit this,     via a specially crafted DAV WRITE request, to cause a     daemon crash, resulting in a denial of service     condition. (CVE-2013-6438)

  - A flaw exists in log_cookie() function due to the     logging of cookies with an unassigned value. A remote     attacker can exploit this, via a specially crafted     request, to cause a segmentation fault, resulting in a     denial of service condition. (CVE-2014-0098)

  - A flaw exists in the deflate_in_filter() function when     request body decompression is configured. A remote     attacker can exploit this, via a specially crafted     request, to exhaust available memory and CPU resources,     resulting in a denial of service condition.
    (CVE-2014-0118)

  - A race condition exists in the mod_status module due to     improper validation of user-supplied input when handling     the scoreboard. A remote attacker can exploit this, via     a crafted request, to cause a heap-based buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2014-0226)

  - A flaw exists in the mod_cgid module due to the lack of     a timeout mechanism. A remote attacker can exploit this,     via a request to a CGI script that does not read from     its stdin file descriptor, to cause a denial of service     condition. (CVE-2014-0231)

This update for apache2 fixes the following issues :

  - Allow disabling SNI on proxy connections using 'SetEnv     proxy-disable-sni 1' in the configuration files.
    (bsc#1052830)

  - Allow ECDH again in mod_ssl, it had been incorrectly     disabled with the 2.2.34 update. (bsc#1064561) Following     security issue has been fixed :

  - CVE-2017-9798: A use-after-free in the OPTIONS command     could be used by attackers to disclose memory of the     apache server process, when htaccess uses incorrect     Limit statement. (bsc#1058058) Additionally, references     to the following security issues, fixed by the previous     version-update of apache2 to Apache HTTPD 2.2.34 have     been added :

  - CVE-2017-7668: The HTTP strict parsing introduced a bug     in token list parsing, which allowed ap_find_token() to     search past the end of its input string. By maliciously     crafting a sequence of request headers, an attacker may     have be able to cause a segmentation fault, or to force     ap_find_token() to return an incorrect value.
    (bsc#1045061)

  - CVE-2017-3169: mod_ssl may have de-referenced a NULL     pointer when third-party modules call     ap_hook_process_connection() during an HTTP request to     an HTTPS port allowing for DoS. (bsc#1045062)

  - CVE-2017-3167: Use of the ap_get_basic_auth_pw() by     third-party modules outside of the authentication phase     may have lead to authentication requirements being     bypassed. (bsc#1045065)

  - CVE-2017-7679: mod_mime could have read one byte past     the end of a buffer when sending a malicious     Content-Type response header. (bsc#1045060)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-466:02 advisory.

    Description :
    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2014-0118     The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before     2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service     (resource consumption) via crafted request data that decompresses to a much larger size.
    CVE-2014-0226     Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to     cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential     information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling     within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker     function in modules/lua/lua_request.c.
    CVE-2014-0231     The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which     allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that     does not read from its stdin file descriptor.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-468:02 advisory.

    Description :
    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2014-0118     The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before     2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service     (resource consumption) via crafted request data that decompresses to a much larger size.
    CVE-2014-0226     Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to     cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential     information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling     within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker     function in modules/lua/lua_request.c.
    CVE-2014-0231     The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which     allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that     does not read from its stdin file descriptor.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

After installing the updated packages, the httpd daemon will be restarted automatically.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
76780	FreeBSD : apache22 -- several vulnerabilities (f927e06c-1109-11e4-b090-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	2014/7/25	2021/1/6	medium
77207	Fedora 19 : httpd-2.4.10-1.fc19 (2014-9057)	Nessus	Fedora Local Security Checks	2014/8/15	2021/1/11	medium
77357	RHEL 5 : Red Hat JBoss Web Server 2.1.0 update (Important) (RHSA-2014:1088)	Nessus	Red Hat Local Security Checks	2014/8/23	2025/4/29	medium
78331	Amazon Linux AMI : httpd (ALAS-2014-388)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
76614	FreeBSD : apache24 -- several vulnerabilities (4364e1f1-0f44-11e4-b090-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	2014/7/21	2021/1/6	medium
76712	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : httpd (SSA:2014-204-01)	Nessus	Slackware Local Security Checks	2014/7/24	2021/1/14	medium
76716	CentOS 7 : httpd (CESA-2014:0921)	Nessus	CentOS Local Security Checks	2014/7/24	2021/1/4	medium
78604	IBM WebSphere Application Server 7.0 < Fix Pack 35 Multiple Vulnerabilities	Nessus	Web Servers	2014/10/21	2018/8/6	medium
82211	Debian DLA-66-1 : apache2 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
84878	Juniper NSM < 2012.2R9 Apache HTTP Server Multiple Vulnerabilities (JSA10685) (credentialed check)	Nessus	Misc.	2015/7/20	2018/7/12	medium
104270	SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)	Nessus	SuSE Local Security Checks	2017/10/31	2025/11/17	critical
289858	MiracleLinux 3 : httpd-2.2.3-87.0.1.AXS3 (AXSA:2014-466:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
290124	MiracleLinux 4 : httpd-2.2.15-31.0.1.AXS4 (AXSA:2014-468:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
76753	Scientific Linux Security Update : httpd on SL5.x, SL6.x i386/x86_64 (20140723)	Nessus	Scientific Linux Local Security Checks	2014/7/24	2021/1/14	medium
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

high

high

medium

critical