The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2478 advisory.

    - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()       authentication bypass
    - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
    - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2479 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before     using it when processing certain headers related to digest authentication. A remote attacker could     possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash     by sending specially crafted requests to a server. (CVE-2017-9788)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use     this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for httpd is now available for Red Hat Enterprise Linux 7.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es) :

* It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788)

* It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167)

* A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169)

* A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668)

* A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

* A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798)

Red Hat would like to thank Hanno Bock for reporting CVE-2017-9798.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3113 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    This release provides an update to httpd, OpenSSL and Tomcat 6/7 for Red Hat JBoss Web Server 2.1.2. The     updates are documented in the Release Notes document linked to in the References.

    This release of Red Hat JBoss Web Server 2.1.2 Service Pack 2 serves as a update for Red Hat JBoss Web     Server 2, and includes bug fixes, which are documented in the Release Notes document linked to in the     References.

    Users of Red Hat JBoss Web Server 2 should upgrade to these updated packages, which resolve several     security issues.

    Security Fix(es):

    * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before     using it when processing certain headers related to digest authentication. A remote attacker could     possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash     by sending specially crafted requests to a server. (CVE-2017-9788)

    * A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false     and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code     execution. (CVE-2017-12615)

    * A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false     and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code     execution. (CVE-2017-12617)

    * A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-     middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted     traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite.
    (CVE-2016-2183)

    * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP     methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use     this flaw to disclose portions of the server memory, or cause httpd child process to crash.
    (CVE-2017-9798)

    Red Hat would like to thank OpenVPN for reporting CVE-2016-2183 and Hanno Bck for reporting     CVE-2017-9798. Upstream acknowledges Karthikeyan Bhargavan (Inria) and Gatan Leurent (Inria) as the     original reporters of CVE-2016-2183.

    Bug Fix(es):

    * Corruption in nodestatsmem in multiple core dumps but in different functions of each core dump.
    (BZ#1338640)

    * mod_cluster segfaults in process_info() due to wrongly generated assembler instruction movslq     (BZ#1448709)

    * CRL checking of very large CRLs fails with OpenSSL 1.0.2 (BZ#1493075)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102514	Oracle Linux 6 : httpd (ELSA-2017-2478)	Nessus	Oracle Linux Local Security Checks	2017/8/16	2025/11/26	critical
102519	RHEL 7 : httpd (RHSA-2017:2479)	Nessus	Red Hat Local Security Checks	2017/8/16	2025/11/26	critical
104539	RHEL 7 : httpd (RHSA-2017:3193) (Optionsbleed)	Nessus	Red Hat Local Security Checks	2017/11/14	2025/11/14	critical
104456	RHEL 6 / 7 : Red Hat JBoss Web Server (RHSA-2017:3113)	Nessus	Red Hat Local Security Checks	2017/11/8	2025/4/15	critical

检测

插件搜索

critical

critical

critical

critical