Updated httpd packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

Several security issues were found in the Apache HTTP server.

  - CVE-2014-0118     The DEFLATE input filter (inflates request bodies) in     mod_deflate allows remote attackers to cause a denial of     service (resource consumption) via crafted request data     that decompresses to a much larger size.

  - CVE-2014-0226     A race condition was found in mod_status. An attacker     able to access a public server status page on a server     could send carefully crafted requests which could lead     to a heap buffer overflow, causing denial of service,     disclosure of sensitive information, or potentially the     execution of arbitrary code.

  - CVE-2014-0231     A flaw was found in mod_cgid. If a server using mod_cgid     hosted CGI scripts which did not consume standard input,     a remote attacker could cause child processes to hang     indefinitely, leading to denial of service.

Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A NULL pointer dereference flaw was found in the mod_cache httpd module. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP Server was used as a forward proxy with caching. (CVE-2013-4352)

A denial of service flaw was found in the mod_proxy httpd module. A remote attacker could send a specially crafted request to a server configured as a reverse proxy using a threaded Multi-Processing Modules (MPM) that would cause the httpd child process to crash.
(CVE-2014-0117)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically.

Updated apache package fixes security vulnerabilities :

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the apache user (CVE-2014-0226).

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the DEFLATE input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system (CVE-2014-0118).

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely (CVE-2014-0231).

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.28. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists within the 'mod_headers' module which     allows a remote attacker to inject arbitrary headers.
    This is done by placing a header in the trailer portion     of data being sent using chunked transfer encoding.
    (CVE-2013-5704)

  - A flaw exists within the 'mod_deflate' module when     handling highly compressed bodies. Using a specially     crafted request, a remote attacker can exploit this to     cause a denial of service by exhausting memory and CPU     resources. (CVE-2014-0118)

  - The 'mod_status' module contains a race condition that     can be triggered when handling the scoreboard. A remote     attacker can exploit this to cause a denial of service,     execute arbitrary code, or obtain sensitive credential     information. (CVE-2014-0226)

  - The 'mod_cgid' module lacks a time out mechanism. Using     a specially crafted request, a remote attacker can use     this flaw to cause a denial of service by causing child     processes to linger indefinitely, eventually filling up     the scoreboard. (CVE-2014-0231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

Updated apache packages fix security vulnerabilities :

Apache HTTPD before 2.4.9 was vulnerable to a denial of service in mod_dav when handling DAV_WRITE requests (CVE-2013-6438).

Apache HTTPD before 2.4.9 was vulnerable to a denial of service when logging cookies (CVE-2014-0098).

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the apache user (CVE-2014-0226).

A denial of service flaw was found in the mod_proxy httpd module. A remote attacker could send a specially crafted request to a server configured as a reverse proxy using a threaded Multi-Processing Modules (MPM) that would cause the httpd child process to crash (CVE-2014-0117).

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the DEFLATE input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system (CVE-2014-0118).

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely (CVE-2014-0231).

A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled (CVE-2014-3581).

mod_lua.c in the mod_lua module in the Apache HTTP Server through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory (CVE-2014-8109).

In the mod_lua module in the Apache HTTP Server through 2.4.10, a maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash (CVE-2015-0228).

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers (CVE-2013-5704).

Note: With this update, httpd has been modified to not merge HTTP Trailer headers with other HTTP request headers. A newly introduced configuration directive MergeTrailers can be used to re-enable the old method of processing Trailer headers, which also re-introduces the aforementioned flaw.

This update also fixes the following bug :

Prior to this update, the mod_proxy_wstunnel module failed to set up an SSL connection when configured to use a back end server using the wss: URL scheme, causing proxied connections to fail. In these updated packages, SSL is used when proxying to wss: back end servers (rhbz#1141950).

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1020 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java     applications based on JBoss Application Server 7.

    A race condition flaw, leading to heap-based buffer overflows, was found in     the mod_status httpd module. A remote attacker able to access a status page     served by mod_status on a server using a threaded Multi-Processing Module     (MPM) could send a specially crafted request that would cause the httpd     child process to crash or, possibly, allow the attacker to execute     arbitrary code with the privileges of the apache user. (CVE-2014-0226)

    A denial of service flaw was found in the way httpd's mod_deflate module     handled request body decompression (configured via the DEFLATE input     filter). A remote attacker able to send a request whose body would be     decompressed could use this flaw to consume an excessive amount of system     memory and CPU on the target system. (CVE-2014-0118)

    A denial of service flaw was found in the way httpd's mod_cgid module     executed CGI scripts that did not read data from the standard input.
    A remote attacker could submit a specially crafted request that would cause     the httpd child process to hang indefinitely. (CVE-2014-0231)

    A flaw was found in the WebSocket08FrameDecoder implementation that could     allow a remote attacker to trigger an Out Of Memory Exception by issuing a     series of TextWebSocketFrame and ContinuationWebSocketFrames. Depending on     the server configuration, this could lead to a denial of service.
    (CVE-2014-0193)

    It was found that the isCallerInRole() method of the SimpleSecurityManager     did not correctly check caller roles. A remote, authenticated attacker     could use this flaw to circumvent the caller check in applications that use     black list access control based on caller roles. (CVE-2014-3472)

    Red Hat would like to thank James Roper of Typesafe for reporting     CVE-2014-0193, and CA Technologies for reporting CVE-2014-3472.

    This release of JBoss Enterprise Application Platform also includes bug     fixes and enhancements. Documentation for these changes will be available     shortly from the JBoss Enterprise Application Platform 6.3.0 Release Notes,     linked to in the References.

    All users who require JBoss Enterprise Application Platform 6.3.0 on Red     Hat Enterprise Linux 6 should install these new packages. The JBoss server     process must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 8.5 prior to Fix Pack 8.5.5.4. It is, therefore, affected by the following vulnerabilities :

  - Multiple errors exist related to the included IBM HTTP     server that can allow remote code execution or denial     of service. (CVE-2013-5704, CVE-2014-0118,     CVE-2014-0226, CVE-2014-0231 / PI22070)

  - An unspecified error exists related to HTTP headers     that can allow information disclosure. (CVE-2014-3021     / PI08268)

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566 /     PI28435, PI28436, PI28437)

  - An unspecified input validation errors exist related to     the administrative console that can allow cross-site     scripting and cross-site request forgery attacks.
    (CVE-2014-4770, CVE-2014-4816 / PI23055)

  - An unspecified error exists that can allow OpenID and     OpenID Connect cookies to be spoofed, allowing     information disclosure. (CVE-2014-6164 / PI23430)

  - An error exists related to the Communications Enabled     Applications (CEA) service that can allow XML External     Entity Injection (XXE) attacks leading to information     disclosure. This only occurs if CEA is enabled. By     default this is disabled. (CVE-2014-6166 / PI25310)

  - An input validation error exists related to session     input using URL rewriting that can allow cross-site     scripting attacks. (CVE-2014-6167 / PI23819)

  - An error exists related to the administrative console     that can allow 'click-jacking' attacks. (CVE-2014-6174 /     PI27152)

  - An error exists related to deployment descriptor     security constraints and ServletSecurity annotations on     a servlet that can allow privilege escalation. Note that     this issue only affects the 'Liberty Profile'.
    (CVE-2014-8890 / PI29911)

The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Apache HTTP Server
  - Client
  - Gateway JARP module
  - Gateway Reverse Proxy
  - OpenSSL
  - Print Servlet (only in 5.0 / 5.1)
  - SGD SSL Daemon (ttassl)
  - Web Server

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-466:02 advisory.

    Description :
    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2014-0118     The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before     2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service     (resource consumption) via crafted request data that decompresses to a much larger size.
    CVE-2014-0226     Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to     cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential     information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling     within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker     function in modules/lua/lua_request.c.
    CVE-2014-0231     The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which     allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that     does not read from its stdin file descriptor.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-468:02 advisory.

    Description :
    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2014-0118     The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before     2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service     (resource consumption) via crafted request data that decompresses to a much larger size.
    CVE-2014-0226     Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to     cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential     information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling     within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker     function in modules/lua/lua_request.c.
    CVE-2014-0231     The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which     allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that     does not read from its stdin file descriptor.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A race condition flaw, leading to heap-based buffer overflows, was found in the mod_status httpd module. A remote attacker able to access a status page served by mod_status on a server using a threaded Multi-Processing Module (MPM) could send a specially crafted request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the 'apache' user. (CVE-2014-0226)

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the 'DEFLATE' input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
(CVE-2014-0118)

A denial of service flaw was found in the way httpd's mod_cgid module executed CGI scripts that did not read data from the standard input. A remote attacker could submit a specially crafted request that would cause the httpd child process to hang indefinitely. (CVE-2014-0231)

After installing the updated packages, the httpd daemon will be restarted automatically.

This update for apache2 fixes the following issues :

  - Allow disabling SNI on proxy connections using 'SetEnv     proxy-disable-sni 1' in the configuration files.
    (bsc#1052830)

  - Allow ECDH again in mod_ssl, it had been incorrectly     disabled with the 2.2.34 update. (bsc#1064561) Following     security issue has been fixed :

  - CVE-2017-9798: A use-after-free in the OPTIONS command     could be used by attackers to disclose memory of the     apache server process, when htaccess uses incorrect     Limit statement. (bsc#1058058) Additionally, references     to the following security issues, fixed by the previous     version-update of apache2 to Apache HTTPD 2.2.34 have     been added :

  - CVE-2017-7668: The HTTP strict parsing introduced a bug     in token list parsing, which allowed ap_find_token() to     search past the end of its input string. By maliciously     crafting a sequence of request headers, an attacker may     have be able to cause a segmentation fault, or to force     ap_find_token() to return an incorrect value.
    (bsc#1045061)

  - CVE-2017-3169: mod_ssl may have de-referenced a NULL     pointer when third-party modules call     ap_hook_process_connection() during an HTTP request to     an HTTPS port allowing for DoS. (bsc#1045062)

  - CVE-2017-3167: Use of the ap_get_basic_auth_pw() by     third-party modules outside of the authentication phase     may have lead to authentication requirements being     bypassed. (bsc#1045065)

  - CVE-2017-7679: mod_mime could have read one byte past     the end of a buffer when sending a malicious     Content-Type response header. (bsc#1045060)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
76749	RHEL 5 / 6 : httpd (RHSA-2014:0920)	Nessus	Red Hat Local Security Checks	2014/7/24	2021/1/14	medium
76844	Debian DSA-2989-1 : apache2 - security update	Nessus	Debian Local Security Checks	2014/7/26	2021/1/11	medium
76905	RHEL 7 : httpd (RHSA-2014:0921)	Nessus	Red Hat Local Security Checks	2014/7/30	2021/1/14	medium
76923	Mandriva Linux Security Advisory : apache (MDVSA-2014:142)	Nessus	Mandriva Local Security Checks	2014/7/31	2021/1/6	medium
77531	Apache 2.2.x < 2.2.28 Multiple Vulnerabilities	Nessus	Web Servers	2014/9/4	2020/4/27	high
78332	Amazon Linux AMI : httpd24 (ALAS-2014-389)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
82346	Mandriva Linux Security Advisory : apache (MDVSA-2015:093)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
77079	RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.3.0 update (Important) (RHSA-2014:1020)	Nessus	Red Hat Local Security Checks	2014/8/8	2025/3/24	medium
80398	IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.4 Multiple Vulnerabilities (POODLE)	Nessus	Web Servers	2015/1/7	2019/11/25	medium
80912	Oracle Secure Global Desktop Multiple Vulnerabilities (January 2015 CPU) (POODLE)	Nessus	Misc.	2015/1/22	2021/10/25	medium
289858	MiracleLinux 3 : httpd-2.2.3-87.0.1.AXS3 (AXSA:2014-466:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
290124	MiracleLinux 4 : httpd-2.2.15-31.0.1.AXS4 (AXSA:2014-468:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
76753	Scientific Linux Security Update : httpd on SL5.x, SL6.x i386/x86_64 (20140723)	Nessus	Scientific Linux Local Security Checks	2014/7/24	2021/1/14	medium
104270	SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)	Nessus	SuSE Local Security Checks	2017/10/31	2025/11/17	critical
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical

检测

插件搜索

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

high

high

medium

critical

critical