Stefan Esser discovered that mod_status did not force a character set, which could result in browsers becoming vulnerable to XSS attacks when processing the output. If a user were tricked into viewing server status output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. By default, mod_status is disabled in Ubuntu. (CVE-2006-5752)

Niklas Edmundsson discovered that the mod_cache module could be made to crash using a specially crafted request. A remote user could use this to cause a denial of service if Apache was configured to use a threaded worker. By default, mod_cache is disabled in Ubuntu.
(CVE-2007-1863)

A flaw was discovered in the signal handling of Apache. A local attacker could trick Apache into sending SIGUSR1 to other processes.
The vulnerable code was only present in Ubuntu Feisty. (CVE-2007-3304).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

バナーによると、リモートホストにインストールされている Apache 2.2 のバージョンは、2.2.6 より前です。そのようなバージョンは、以下を含むいくつかの問題の影響を受けることがあります。

  - mod_proxy でのサービス拒否脆弱性。 
  - mod_status でのクロスサイトスクリプティング脆弱性。
  - Prefork MPM モジュールに関連するローカルサービス拒否脆弱性。
  - mod_cache での情報漏洩。
  - mod_cache でのサービス拒否脆弱性。

さらに、mod_autoindex でのクロスサイトスクリプティング問題の回避策が提供されます。 

リモート Web サーバーは、実際にはこれらの脆弱性の影響を受けない場合があることに、注意してください。Nessus は、影響を受けるモジュールのいずれかがリモートサーバーで使用されているか、または問題そのものを確認しようとしませんでした。

根据其标题，远程主机上运行的 Apache 2.2.x 版本低于 2.2.6。因此，该应用程序受到以下漏洞的影响：

  - mod_proxy 中的拒绝服务漏洞。 
  - mod_status 中的跨站脚本漏洞。
  - 与 Prefork MPM 模块相关的本地拒绝服务漏洞。
  - mod_cache 中的信息泄漏。
  - mod_cache 中的拒绝服务漏洞。

此外，它提供了针对 mod_autoindex 中跨站脚本问题的变通办法。 

请注意远程 Web 服务器实际上可能不会受到这些漏洞的影响。Nessus 未尝试确定远程服务器上是否使用任何受影响的模块或检查问题本身。

A vulnerability was discovered in the the Apache mod_status module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled (CVE-2006-5752).

A vulnerability was found in the Apache mod_cache module that could cause the httpd server child process to crash if it was sent a carefully crafted request. This could lead to a denial of service if using a threaded MPM (CVE-2007-1863).

The Apache server also did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the server could manipulate the scoreboard and cause arbitrary processes to be terminated (CVE-2007-3304).

Updated packages have been patched to prevent the above issues.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.6. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability in mod_proxy. 
  - A cross-site scripting vulnerability in mod_status.
  - A local denial of service vulnerability associated with     the Prefork MPM module.
  - An information leak in mod_cache.
  - A denial of service vulnerability in mod_cache.

In addition, it offers a workaround for a cross-site scripting issue in mod_autoindex. 

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether any of the affected modules are in use on the remote server or to check for the issues themselves.

根據其標題，遠端主機上執行的 Apache 2.2.x 版本比 2.2.6 舊。因此，該應用程式受到以下弱點影響：

  - mod_proxy 中的拒絕服務弱點。 
  - mod_status 中的跨網站指令碼弱點。
  - 與 Prefork MPM 模組相關的本機拒絕服務弱點。
  - mod_cache 中的資訊洩漏。
  - mod_cache 中的拒絕服務弱點。

此外，還提供 mod_autoindex 跨網站指令碼問題的因應措施。 

請注意，遠端 Web 伺服器可能實際上並不會受這些弱點影響。Nessus 並未嘗試判斷受影響的模組是否仍在遠端伺服器上使用中，也未嘗試檢查問題本身。

ID	名稱	產品	系列	已發布	已更新	嚴重性
28102	Ubuntu 6.06 LTS / 6.10 / 7.04 : apache2 vulnerabilities (USN-499-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	medium
26023	Apache < 2.2.6 の複数の脆弱性（DoS、XSS、Info Disc）	Nessus	Web Servers	2007/9/14	2018/6/29	medium
26023	Apache 2.2.x < 2.2.6 多个漏洞（DoS、XSS、信息泄露）	Nessus	Web Servers	2007/9/14	2018/6/29	medium
25670	Mandrake Linux Security Advisory : apache (MDKSA-2007:140)	Nessus	Mandriva Local Security Checks	2007/7/5	2021/1/6	medium
26023	Apache 2.2.x < 2.2.6 Multiple Vulnerabilities (DoS, XSS, Info Disc)	Nessus	Web Servers	2007/9/14	2018/6/29	medium
26023	Apache 2.2.x < 2.2.6 多個弱點 (DoS、XSS、Info Disc)	Nessus	Web Servers	2007/9/14	2018/6/29	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium