A vulnerability has been found in the Apache HTTP Server.

CVE-2015-3183

Apache HTTP Server did not properly parse chunk headers, which allowed remote attackers to conduct HTTP request smuggling via a crafted request. This flaw relates to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c.

For the squeeze distribution, these issues have been fixed in version 2.2.16-6+squeeze15 of apache2.

We recommend you to upgrade your apache2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated httpd packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

All httpd users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the httpd service will be restarted automatically.

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and prevent further, legitimate connections to the Tomcat server.
(CVE-2014-0230)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

* This enhancement update adds the Red Hat JBoss Web Server 3.0.2 packages to Red Hat Enterprise Linux 6. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-228)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

Jim Jagielski reports :

CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect.
Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters.

CVE-2015-3185 (cve.mitre.org) Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook.

CVE-2015-0253 (cve.mitre.org) core: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. PR 57531.

CVE-2015-0228 (cve.mitre.org) mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash.

Update to new version 2.4.16. This update fixed various bugs as well as few security issues.

For full changelog, see http://www.apache.org/dist/httpd/CHANGES_2.4.16

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

After installing the updated packages, the httpd service will be restarted automatically.

The Tenable SecurityCenter application installed on the remote host contains a bundled version of Apache HTTP Server prior to 2.4.16. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the chunked transfer coding     implementation in http_filters.c. due to a failure to     properly parse chunk headers when handling large     chunk-size values and invalid chunk-extension     characters. A remote attacker can exploit this, via a     crafted request, to carry out HTTP request smuggling,     potentially resulting in cache poisoning or the     hijacking of credentials. (CVE-2015-3183)

  - A security bypass vulnerability exists due to a failure     in the ap_some_auth_required() function in request.c to     consider that a Require directive may be associated with     an authorization setting instead of an authentication     setting. A remote attacker can exploit this, by     leveraging the presence of a module that relies on the     2.2 API behavior, to bypass intended access restrictions     under certain circumstances.
    (CVE-2015-3185)

Note that the 4.x version of SecurityCenter is impacted only by CVE-2015-3183. The 5.x version is impacted by both CVE-2015-3183 and CVE-2015-3185

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1668 advisory.

    - fix regressions caused by fix for CVE-2015-3183

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly indicate that a request was authenticated even when no authentication was used. An httpd module using this API function could consequently allow access that should have been denied. (CVE-2015-3185)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

A NULL pointer dereference flaw was found in the way httpd generated certain error responses. A remote attacker could possibly use this flaw crash the httpd child process using a request that triggers a certain HTTP error. (CVE-2015-0253)

A denial of service flaw was found in the way the mod_lua httpd module processed certain WebSocket Ping requests. A remote attacker could send a specially crafted WebSocket Ping packet that would cause the httpd child process to crash. (CVE-2015-0228)

Several vulnerabilities have been found in the Apache HTTPD server.

  - CVE-2015-3183     An HTTP request smuggling attack was possible due to a     bug in parsing of chunked requests. A malicious client     could force the server to misinterpret the request     length, allowing cache poisoning or credential hijacking     if an intermediary proxy is in use.

  - CVE-2015-3185     A design error in the 'ap_some_auth_required' function     renders the API unusuable in apache2 2.4.x. This could     lead to modules using this API to allow access when they     should otherwise not do so. The fix backports the new     'ap_some_authn_required' API from 2.4.16. This issue     does not affect the oldstable distribution (wheezy).

In addition, the updated package for the oldstable distribution (wheezy) removes a limitation of the Diffie-Hellman (DH) parameters to 1024 bits. This limitation may potentially allow an attacker with very large computing resources, like a nation-state, to break DH key exchange by precomputation. The updated apache2 package also allows to configure custom DH parameters. More information is contained in the changelog.Debian.gz file. These improvements were already present in the stable, testing, and unstable distributions.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1668 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient,     and extensible web server.

    Multiple flaws were found in the way httpd parsed HTTP requests and     responses using chunked transfer encoding. A remote attacker could use     these flaws to create a specially crafted request, which httpd would decode     differently from an HTTP proxy software in front of it, possibly leading to     HTTP request smuggling attacks. (CVE-2015-3183)

    All httpd users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing the     updated packages, the httpd service will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apache 2.4.x installed on the remote host is prior to 2.4.16. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - A flaw exists in the RC4 algorithm due to an initial     double-byte bias in the keystream generation. An     attacker can exploit this, via Bayesian analysis that     combines an a priori plaintext distribution with     keystream distribution statistics, to conduct a     plaintext recovery of the ciphertext. Note that RC4     cipher suites are prohibited per RFC 7465. This issue     was fixed in Apache version 2.4.13; however, 2.4.13,     2.4.14, and 2.4.15 were never publicly released.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and prevent further, legitimate connections to the Tomcat server.
(CVE-2014-0230)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

* This enhancement update adds the Red Hat JBoss Web Server 3.0.2 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-229)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - CoreText
  - FontParser
  - Libinfo
  - libxml2
  - OpenSSL
  - perl
  - PostgreSQL
  - QL Office
  - Quartz Composer Framework
  - QuickTime 7
  - SceneKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_headers module that allows HTTP     trailers to replace HTTP headers late during request     processing. A remote attacker can exploit this to inject     arbitrary headers. This can also cause some modules to     function incorrectly or appear to function incorrectly.
    (CVE-2013-5704)

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. (CVE-2014-0067)

  - A NULL pointer dereference flaw exists in module     mod_cache. A remote attacker, using an empty HTTP     Content-Type header, can exploit this vulnerability to     crash a caching forward proxy configuration, resulting     in a denial of service if using a threaded MPM.
    (CVE-2014-3581)

  - A out-of-bounds memory read flaw exists in module     mod_proxy_fcgi. An attacker, using a remote FastCGI     server to send long response headers, can exploit this     vulnerability to cause a denial of service by causing     a buffer over-read. (CVE-2014-3583)

  - A flaw exists in module mod_lua when handling a     LuaAuthzProvider used in multiple Require directives     with different arguments. An attacker can exploit this     vulnerability to bypass intended access restrictions.
    (CVE-2014-8109)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - A flaw exists in PostgreSQL client disconnect timeout     expiration that is triggered when a timeout interrupt     is fired partway through the session shutdown sequence.     (CVE-2015-3165)

  - A flaw exists in the printf() functions due to a failure     to check for errors. A remote attacker can use this to     gain access to sensitive information. (CVE-2015-3166)

  - The pgcrypto component in PostgreSQL has multiple error     messages for decryption with an incorrect key. A remote     attacker can use this to recover keys from other     systems. (CVE-2015-3167)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - Multiple unspecified XML flaws exist in the Wiki Server     based on Twisted. (CVE-2015-5911)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85051	Debian DLA-284-1 : apache2 security update	Nessus	Debian Local Security Checks	2015/7/29	2021/1/11	medium
85637	CentOS 6 : httpd (CESA-2015:1668)	Nessus	CentOS Local Security Checks	2015/8/26	2021/1/4	medium
87457	RHEL 6 : JBoss Web Server (RHSA-2015:2659)	Nessus	Red Hat Local Security Checks	2015/12/17	2021/2/5	medium
84781	FreeBSD : apache24 -- multiple vulnerabilities (a12494c1-2af4-11e5-86ff-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2015/7/16	2021/1/6	medium
84906	Fedora 22 : httpd-2.4.16-1.fc22 (2015-11689)	Nessus	Fedora Local Security Checks	2015/7/22	2021/1/11	medium
85092	Fedora 21 : httpd-2.4.16-1.fc21 (2015-11792)	Nessus	Fedora Local Security Checks	2015/7/30	2021/1/11	medium
85620	Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20150824)	Nessus	Scientific Linux Local Security Checks	2015/8/25	2021/1/14	medium
85628	Tenable SecurityCenter Multiple Apache Vulnerabilities (TNS-2015-11)	Nessus	Web Servers	2015/8/25	2023/11/27	medium
85451	Amazon Linux AMI : httpd (ALAS-2015-578)	Nessus	Amazon Linux Local Security Checks	2015/8/18	2018/4/18	medium
85614	Oracle Linux 6 : httpd (ELSA-2015-1668)	Nessus	Oracle Linux Local Security Checks	2015/8/25	2024/10/22	high
85452	Amazon Linux AMI : httpd24 (ALAS-2015-579)	Nessus	Amazon Linux Local Security Checks	2015/8/18	2018/4/18	medium
85164	Debian DSA-3325-1 : apache2 - security update	Nessus	Debian Local Security Checks	2015/8/3	2021/1/11	medium
85618	RHEL 6 : httpd (RHSA-2015:1668)	Nessus	Red Hat Local Security Checks	2015/8/25	2025/4/15	high
84959	Apache 2.4.x < 2.4.16 Multiple Vulnerabilities	Nessus	Web Servers	2015/7/23	2022/4/11	medium
87458	RHEL 7 : JBoss Web Server (RHSA-2015:2660)	Nessus	Red Hat Local Security Checks	2015/12/17	2021/2/5	medium
85409	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)	Nessus	MacOS X Local Security Checks	2015/8/17	2024/5/28	high
86066	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high

medium

medium

high

critical