The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-347:01 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    Security issues fixed with this release:
    CVE-2013-5704     The mod_headers module in the Apache HTTP Server 2.2.22 allows remote     attackers to bypass RequestHeader unset directives by placing a     header in the trailer portion of data sent with chunked transfer     coding.  NOTE: the vendor states this is not a security issue in httpd     as such.
    Fixed bugs:
    * The order of mod_proxy workers was not checked when httpd configuration was     reloaded. When mod_proxy workers were removed, added, or their order was     changed, their parameters and scores could become mixed. With this update,     the order of mod_proxy workers has been made internally consistent during     configuration reload.
    * The local host certificate created during firstboot contained CA extensions,     which caused the httpd service to return warning messages. With this update,     the bug hes been fixed.
    * The default mod_ssl configuration no longer enables support for SSL cipher     suites using the single DES, IDEA, or SEED encryption algorithms.
    * The apachectl script did not take into account the HTTPD_LANG variable set in     the /etc/sysconfig/httpd file during graceful restarts. Consequently, httpd did     not use a changed value of HTTPD_LANG when the daemon was restarted gracefully.
    To fix this bug, the script has been fixed to handle the HTTPD_LANG variable correctly.
    * The mod_deflate module failed to check the original file size while extracting     files larger than 4 GB, making it impossible to extract large files. With this update,     the problem has been fixed.
    * The httpd service did not check configuration before restart. When a     configuration contained an error, an attempt to restart httpd gracefully failed.
    With this update, the problem has been fixed.
    * The SSL_CLIENT_VERIFY environment variable was incorrectly handled when the     SSLVerifyClient optional_no_ca and SSLSessionCache options were used. When     an SSL session was resumed, the SSL_CLIENT_VERIFY value was set to SUCCESS     instead of the previously set GENEROUS. SSL_CLIENT_VERIFY is now correctly set     to GENEROUS in this scenario.
    * The ab utility did not correctly handle situations when an SSL connection was     closed after some data had already been read. As a consequence, ab did not work     correctly with SSL servers and printed SSL read failed error messages. With     this update, the described bug has been fixed.
    * When a client presented a revoked certificate, log entries were created only     at the debug level. The log level of messages regarding a revoked certificate     has been increased to INFO, and administrators are now properly informed of this     situation.
    Enhancements:
    * A mod_proxy worker can now be set into drain mode (N) using the     balancer-manager web interface or using the httpd configuration file. A worker     in drain mode accepts only existing sticky sessions destined for itself and     ignores all other requests. The worker waits until all clients currently     connected to this worker complete their work before the worker is stopped. As a     result, drain mode enables to perform maintenance on a worker without affecting     clients.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and prevent further, legitimate connections to the Tomcat server.
(CVE-2014-0230)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

* This enhancement update adds the Red Hat JBoss Web Server 3.0.2 packages to Red Hat Enterprise Linux 6. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-228)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

Updated httpd and httpd22 packages that fix two security issues are now available for Red Hat JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Users of httpd or httpd22 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
After installing the updated packages, the httpd or httpd22 service must be restarted manually for this update to take effect.

The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities, as follows:

  - Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c. (CVE-2014-0226)

  - The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor. (CVE-2014-0231)

  - The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size. (CVE-2014-0118)

  - The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding.
NOTE: the vendor states 'this is not a security issue in httpd as such.' (CVE-2013-5704)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.28. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists within the 'mod_headers' module which     allows a remote attacker to inject arbitrary headers.
    This is done by placing a header in the trailer portion     of data being sent using chunked transfer encoding.
    (CVE-2013-5704)

  - A flaw exists within the 'mod_deflate' module when     handling highly compressed bodies. Using a specially     crafted request, a remote attacker can exploit this to     cause a denial of service by exhausting memory and CPU     resources. (CVE-2014-0118)

  - The 'mod_status' module contains a race condition that     can be triggered when handling the scoreboard. A remote     attacker can exploit this to cause a denial of service,     execute arbitrary code, or obtain sensitive credential     information. (CVE-2014-0226)

  - The 'mod_cgid' module lacks a time out mechanism. Using     a specially crafted request, a remote attacker can use     this flaw to cause a denial of service by causing child     processes to linger indefinitely, eventually filling up     the scoreboard. (CVE-2014-0231)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1625 advisory.

    This advisory aggregates security fixes for the httpd SRPM in CIQ LTS 9.2. It addresses 24 CVEs:
    CVE-2023-25690, CVE-2023-31122, CVE-2022-28615, CVE-2014-3581, CVE-2021-44790, and 19 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1972 advisory.

    - Remove mod_proxy_fcgi fix for heap-based buffer overflow,       httpd-2.4.6 is not affected (CVE-2014-3583)
    - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
    - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
    - mod_proxy_fcgi: fix heap-based buffer overflow (CVE-2014-3583)
    - mod_cgid: add security fix for CVE-2014-0231
    - mod_proxy: add security fix for CVE-2014-0117
    - mod_deflate: add security fix for CVE-2014-0118
    - mod_status: add security fix for CVE-2014-0226

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- core: fix bypassing of mod_headers rules via chunked     requests (CVE-2013-5704)

    - mod_cache: fix NULL pointer dereference on empty       Content-Type (CVE-2014-3581)

    - mod_proxy_fcgi: fix a potential crash with long       headers (CVE-2014-3583)

    - mod_lua: fix handling of the Require line when a       LuaAuthzProvider is used in multiple Require       directives with different arguments (CVE-2014-8109)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

This update also fixes the following bugs :

  - The order of mod_proxy workers was not checked when     httpd configuration was reloaded. When mod_proxy workers     were removed, added, or their order was changed, their     parameters and scores could become mixed. The order of     mod_proxy workers has been made internally consistent     during configuration reload.

  - The local host certificate created during firstboot     contained CA extensions, which caused the httpd service     to return warning messages. This has been addressed by     local host certificates being generated with the     '-extensions v3_req' option.

  - The default mod_ssl configuration no longer enables     support for SSL cipher suites using the single DES,     IDEA, or SEED encryption algorithms.

  - The apachectl script did not take into account the     HTTPD_LANG variable set in the /etc/sysconfig/httpd file     during graceful restarts. Consequently, httpd did not     use a changed value of HTTPD_LANG when the daemon was     restarted gracefully. The script has been fixed to     handle the HTTPD_LANG variable correctly.

  - The mod_deflate module failed to check the original file     size while extracting files larger than 4 GB, making it     impossible to extract large files. Now, mod_deflate     checks the original file size properly according to     RFC1952, and it is able to decompress files larger than     4 GB.

  - The httpd service did not check configuration before     restart. When a configuration contained an error, an     attempt to restart httpd gracefully failed. Now, httpd     checks configuration before restart and if the     configuration is in an inconsistent state, an error     message is printed, httpd is not stopped and a restart     is not performed.

  - The SSL_CLIENT_VERIFY environment variable was     incorrectly handled when the 'SSLVerifyClient     optional_no_ca' and 'SSLSessionCache' options were used.
    When an SSL session was resumed, the SSL_CLIENT_VERIFY     value was set to 'SUCCESS' instead of the previously set     'GENEROUS'. SSL_CLIENT_VERIFY is now correctly set to     GENEROUS in this scenario.

  - The ab utility did not correctly handle situations when     an SSL connection was closed after some data had already     been read. As a consequence, ab did not work correctly     with SSL servers and printed 'SSL read failed' error     messages. With this update, ab works as expected with     HTTPS servers.

  - When a client presented a revoked certificate, log     entries were created only at the debug level. The log     level of messages regarding a revoked certificate has     been increased to INFO, and administrators are now     properly informed of this situation.

In addition, this update adds the following enhancement :

  - A mod_proxy worker can now be set into drain mode (N)     using the balancer-manager web interface or using the     httpd configuration file. A worker in drain mode accepts     only existing sticky sessions destined for itself and     ignores all other requests. The worker waits until all     clients currently connected to this worker complete     their work before the worker is stopped. As a result,     drain mode enables to perform maintenance on a worker     without affecting clients.

After installing the updated packages, the httpd service will be restarted automatically.

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass 'RequestHeader unset' directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states 'this is not a security issue in httpd as such.' (CVE-2013-5704)

Updated Red Hat JBoss Web Server 3.0.2 packages are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

It was found that Tomcat would keep connections open after processing requests with a large enough request body. A remote attacker could potentially use this flaw to exhaust the pool of available connections and prevent further, legitimate connections to the Tomcat server.
(CVE-2014-0230)

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
(CVE-2013-5704)

Multiple flaws were found in the way httpd parsed HTTP requests and responses using chunked transfer encoding. A remote attacker could use these flaws to create a specially crafted request, which httpd would decode differently from an HTTP proxy software in front of it, possibly leading to HTTP request smuggling attacks. (CVE-2015-3183)

* This enhancement update adds the Red Hat JBoss Web Server 3.0.2 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-229)

Users of Red Hat JBoss Web Server are advised to upgrade to these updated packages, which add this enhancement.

The remote Mac OS X host has a version of OS X Server installed that is prior to 5.0.3. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_headers module that allows HTTP     trailers to replace HTTP headers late during request     processing. A remote attacker can exploit this to inject     arbitrary headers. This can also cause some modules to     function incorrectly or appear to function incorrectly.
    (CVE-2013-5704)

  - A privilege escalation vulnerability exists due to the     'make check' command not properly invoking initdb to     specify authentication requirements for a database     cluster to be used for tests. A local attacker can     exploit this issue to gain temporary server access and     elevated privileges. (CVE-2014-0067)

  - A NULL pointer dereference flaw exists in module     mod_cache. A remote attacker, using an empty HTTP     Content-Type header, can exploit this vulnerability to     crash a caching forward proxy configuration, resulting     in a denial of service if using a threaded MPM.
    (CVE-2014-3581)

  - A out-of-bounds memory read flaw exists in module     mod_proxy_fcgi. An attacker, using a remote FastCGI     server to send long response headers, can exploit this     vulnerability to cause a denial of service by causing     a buffer over-read. (CVE-2014-3583)

  - A flaw exists in module mod_lua when handling a     LuaAuthzProvider used in multiple Require directives     with different arguments. An attacker can exploit this     vulnerability to bypass intended access restrictions.
    (CVE-2014-8109)

  - An information disclosure vulnerability exists due to     improper handling of restricted column values in     constraint-violation error messages. An authenticated,     remote attacker can exploit this to gain access to     sensitive information. (CVE-2014-8161)

  - A flaw exists within the Domain Name Service due to an     error in the code used to follow delegations. A remote     attacker, with a maliciously-constructed zone or query,     can cause the service to issue unlimited queries,     resulting in resource exhaustion. (CVE-2014-8500)

  - A flaw exists in the lua_websocket_read() function in     the 'mod_lua' module due to incorrect handling of     WebSocket PING frames. A remote attacker can exploit     this, by sending a crafted WebSocket PING frame after a     Lua script has called the wsupgrade() function, to crash     a child process, resulting in a denial of service     condition. (CVE-2015-0228)

  - Multiple vulnerabilities exist due to several buffer     overflow errors related to the 'to_char' functions. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0241)

  - Multiple vulnerabilities exist due to several     stack-based buffer overflow errors in various *printf()     functions. The overflows are due to improper validation     of user-supplied input when formatting a floating point     number where the requested precision is greater than     approximately 500. An authenticated, remote attacker     can exploit these issues to cause a denial of service or     arbitrary code execution. (CVE-2015-0242)

  - Multiple vulnerabilities exist due to an overflow     condition in multiple functions in the 'pgcrypto'     extension. The overflows are due to improper validation     of user-supplied input when tracking memory sizes. An     authenticated, remote attacker can exploit these issues     to cause a denial of service or arbitrary code     execution. (CVE-2015-0243)

  - A SQL injection vulnerability exists due to improper     sanitization of user-supplied input when handling     crafted binary data within a command parameter. An     authenticated, remote attacker can exploit this issue     to inject or manipulate SQL queries, allowing the     manipulation or disclosure of arbitrary data.
    (CVE-2015-0244)

  - A NULL pointer dereference flaw exists in the     read_request_line() function due to a failure to     initialize the protocol structure member. A remote     attacker can exploit this flaw, on installations that     enable the INCLUDES filter and has an ErrorDocument 400     directive specifying a local URI, by sending a request     that lacks a method, to cause a denial of service     condition. (CVE-2015-0253)

  - A denial of service vulnerability exists due to an error     relating to DNSSEC validation and the managed-keys     feature. A remote attacker can trigger an incorrect     trust-anchor management scenario in which no key is     ready for use, resulting in an assertion failure and     daemon crash. (CVE-2015-1349)

  - A flaw exists in PostgreSQL client disconnect timeout     expiration that is triggered when a timeout interrupt     is fired partway through the session shutdown sequence.     (CVE-2015-3165)

  - A flaw exists in the printf() functions due to a failure     to check for errors. A remote attacker can use this to     gain access to sensitive information. (CVE-2015-3166)

  - The pgcrypto component in PostgreSQL has multiple error     messages for decryption with an incorrect key. A remote     attacker can use this to recover keys from other     systems. (CVE-2015-3167)

  - A flaw exists in the chunked transfer coding     implementation due to a failure to properly parse chunk     headers. A remote attacker can exploit this to conduct     HTTP request smuggling attacks. (CVE-2015-3183)

  - A flaw exists in the ap_some_auth_required() function     due to a failure to consider that a Require directive     may be associated with an authorization setting rather     than an authentication setting. A remote attacker can     exploit this, if a module that relies on the 2.2 API     behavior exists, to bypass intended access restrictions.
    (CVE-2015-3185)

  - Multiple unspecified XML flaws exist in the Wiki Server     based on Twisted. (CVE-2015-5911)

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名稱	產品	系列	已發布	已更新	嚴重性
288961	MiracleLinux 4 : httpd-2.2.15-45.0.1.AXS4 (AXSA:2015-347:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
87457	RHEL 6 : JBoss Web Server (RHSA-2015:2659)	Nessus	Red Hat Local Security Checks	2015/12/17	2021/2/5	medium
88077	RHEL 5 / 6 / 7 : JBoss Web Server (RHSA-2016:0061)	Nessus	Red Hat Local Security Checks	2016/1/22	2019/10/24	medium
144289	IBM HTTP Server 8.5.0.0 <= 8.5.5.2 / 8.0.0.0 <= 8.0.0.9 / 7.0.0.0 <= 7.0.0.33 / 6.1.0.0. <= 6.1.0.47 / 6.0.2.0 <= 6.0.2.43 Multiple Vulnerabilities (509275)	Nessus	Web Servers	2020/12/15	2022/4/11	high
77531	Apache 2.2.x < 2.2.28 Multiple Vulnerabilities	Nessus	Web Servers	2014/9/4	2020/4/27	high
364610	Rocky Linux 9.2 [CIQ] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc Multiple Vulnerabilities (ciqsa-2026_1625)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	critical
181022	Oracle Linux 6 : httpd24-httpd (ELSA-2014-1972)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	high
81837	Fedora 21 : httpd-2.4.10-15.fc21 (2014-17195)	Nessus	Fedora Local Security Checks	2015/3/17	2021/1/11	medium
85196	Scientific Linux Security Update : httpd on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2021/1/14	medium
91367	F5 Networks BIG-IP : Apache vulnerability (K16863)	Nessus	F5 Networks Local Security Checks	2016/5/31	2021/3/10	medium
87458	RHEL 7 : JBoss Web Server (RHSA-2015:2660)	Nessus	Red Hat Local Security Checks	2015/12/17	2021/2/5	medium
86066	Mac OS X : OS X Server < 5.0.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/9/22	2019/11/22	critical
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical

偵測

搜尋 Plugin

high

medium

medium

high

high

critical

high

medium

medium

medium

medium

critical

critical