According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.27. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in httpd due to     a failure to initialize or reset the value placeholder     in [Proxy-]Authorization headers of type 'Digest' before     or between successive key=value assignments by     mod_auth_digest. An unauthenticated, remote attacker can     exploit this, by providing an initial key with no '='     assignment, to disclose sensitive information or cause a     denial of service condition. (CVE-2017-9788)

  - A read-after-free error exists in httpd that is     triggered when closing a large number of connections. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact. (CVE-2017-9789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2483 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before     using it when processing certain headers related to digest authentication. A remote attacker could     possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash     by sending specially crafted requests to a server. (CVE-2017-9788)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A NULL pointer dereference flaw was found in the mod_http2 module of httpd. A remote attacker could use     this flaw to cause httpd child process to crash via a specially crafted HTTP/2 request. (CVE-2017-7659)

    * A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use     this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - 802.1X
  - apache
  - AppleScript
  - ATS
  - Audio
  - CFString
  - CoreText
  - curl
  - Dictionary Widget
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - ImageIO
  - Kernel
  - libarchive
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - Sandbox
  - StreamingZip
  - tcpdump
  - Wi-Fi

The remote host is affected by the vulnerability described in GLSA-201710-32 (Apache: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache. Please review       the referenced CVE identifiers for details.
  Impact :

    The Optionsbleed vulnerability can leak arbitrary memory from the server       process that may contain secrets.  Additionally attackers may cause a       Denial of Service condition, bypass authentication, or cause information       loss.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101788	Apache 2.4.x < 2.4.27 Multiple Vulnerabilities	Nessus	Web Servers	2017/7/18	2022/4/11	critical
210279	RHEL 6 / 7 : httpd24-httpd (RHSA-2017:2483)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	critical
104379	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004)	Nessus	MacOS X Local Security Checks	2017/11/3	2025/11/14	critical
104233	GLSA-201710-32 : Apache: Multiple vulnerabilities (Optionsbleed)	Nessus	Gentoo Local Security Checks	2017/10/30	2025/11/17	critical

检测

插件搜索

critical

critical

critical

critical