This update of libapr-util1 and libapr1 fixes multiple integer overflows that could probably be used to execute arbitrary code remotely. (CVE-2009-2412)

According to its self-reported banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.13. As such, it includes a bundled version of the Apache Portable Runtime (APR) library that contains a flaw in 'apr_palloc()' that could cause a heap overflow. 

Note that the Apache HTTP server itself does not pass unsanitized, user-provided sizes to this function so it could only be triggered through some other application that uses it in a vulnerable way.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1204 advisory.

    - add security fix for CVE-2009-2412 (#515709)

    apr-util:

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The following bugs have been fixed : 

  - Integer overflows in libapr could potentially be     exploited to execute arbitrary code. (CVE-2009-2412)

  - Specially crafted XML documents cause apache to consume     large amounts of memory. (CVE-2009-1955)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.2.  Mac OS X 10.6.2 contains security fixes for the following products : 

  - Adaptive Firewall

  - Apache

  - Apache Protable Runtime

  - Certificate Assistant

  - CoreMedia

  - CUPS

  - DoveCot

  - fetchmail

  - file

  - FTP Server

  - Help Viewer

  - ImageIO

  - IOKit

  - IPSec

  - Kernel

  - Launch Services

  - libsecurity

  - libxml

 Login Window

  - OpenLDAP

  - QuickDraw Manager

QuickTime

  - Screen Sharing

  - Subversion

ID	名稱	產品	系列	已發布	已更新	嚴重性
42236	SuSE 10 Security Update : libapr (ZYPP Patch Number 6546)	Nessus	SuSE Local Security Checks	2009/10/23	2021/1/14	critical
57603	Apache 2.2.x < 2.2.13 APR apr_palloc Heap Overflow	Nessus	Web Servers	2012/1/19	2018/6/29	critical
67907	Oracle Linux 5 : apr / and / apr-util (ELSA-2009-1204)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
46217	SuSE9 Security Update : Apache 2 (YOU Patch Number 12613)	Nessus	SuSE Local Security Checks	2010/5/4	2021/1/14	critical
5227	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2009/11/10	2019/3/6	critical
800795	Mac OS X 10.6 < 10.6.2 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	2009/11/10		high

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

high