The remote host appears to be running a version of Apache which is older  than 1.3.29  There are several flaws in this version that may allow an attacker to possibly execute arbitrary code through mod_alias and mod_rewrite.

The remote host appears to be running a version of Apache 2.x that is older than 2.0.48.  This version is vulnerable to a bug that may allow a rogue CGI to disable the httpd service by issuing over 4K of data to stderr. To exploit this flaw, an attacker would need the ability to upload a rogue CGI script to this server and to have it executed by the Apache daemon (httpd).

远程主机运行的 Apache 2.0.x 版本似乎低于 2.0.48。因此，该服务器受到多个漏洞的影响：

  - mod_rewrite 和 mod_alias 模块无法处理包含超过 9 个捕获的正则表达式，可导致缓冲区溢出。

  - 可能会因 CGI 重定向路径的错误处理在 mod_cgid 出现漏洞。这可导致 Apache 将 CGI 程序的输出发送给错误的客户端。

リモートホストは、2.0.48 より古いバージョンの Apache 2.x を実行しているようです。このようなバージョンは、報告されているところによれば、複数の脆弱性の影響を受けます。

  -  mod_rewrite および mod_alias モジュールは、9 件を超えるキャプチャが含まれている正規表現を処理することができず、バッファオーバーフローが発生します。

  - CGI リダイレクトパスの取り扱いミスによって mod_cgid モジュール内で脆弱性が発生することがあります。これにより、Apache が不適切なクライアントに CGI プログラムの出力を送信することがあります。

The remote host appears to be running a version of Apache 2.0.x prior to 2.0.48. It is, therefore, affected by multiple vulnerabilities :

  - The mod_rewrite and mod_alias modules fail to handle     regular expressions containing more than 9 captures     resulting in a buffer overflow.

  - A vulnerability may occur in the mod_cgid module caused     by the mishandling of CGI redirect paths. This could     cause Apache to send the output of a CGI program to the     wrong client.

A buffer overflow in mod_alias and mod_rewrite was discovered in Apache versions 1.3.19 and earlier as well as Apache 2.0.47 and earlier. This happens when a regular expression with more than 9 captures is confined. An attacker would have to create a carefully crafted configuration file (.htaccess or httpd.conf) in order to exploit these problems.

As well, another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used.

Apache version 2.0.48 and 1.3.29 were released upstream to correct these bugs; backported patches have been applied to the provided packages.

The remote host is missing Security Update 2004-01-26.

This security update includes the following components :

 - Apache 1.3
 - Classic
 - Mail
 - Safari
 - Windows File Sharing

For MacOS 10.1.5, it only includes the following :

 - Mail

This update contains various fixes which may allow an attacker to execute arbitrary code on the remote host.

ID	名稱	產品	系列	已發布	已更新	嚴重性
2174	Apache < 1.3.29 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2004/8/30	2019/3/6	high
2175	Apache < 2.0.48 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2004/8/30	2019/3/6	high
11853	Apache 2.0.x < 2.0.48 多个漏洞（OF、信息泄露）	Nessus	Web Servers	2003/9/26	2018/11/15	critical
11853	Apache < 2.0.48 の複数の脆弱性（OF、Info Disc.）	Nessus	Web Servers	2003/9/26	2018/11/15	critical
11853	Apache 2.0.x < 2.0.48 Multiple Vulnerabilities (OF, Info Disc.)	Nessus	Web Servers	2003/9/26	2018/11/15	critical
14085	Mandrake Linux Security Advisory : apache (MDKSA-2003:103)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	critical
12517	Mac OS X Multiple Vulnerabilities (Security Update 2004-01-26)	Nessus	MacOS X Local Security Checks	2004/7/6	2024/5/28	critical

偵測

搜尋 Plugin

high

high

critical

critical

critical

critical

critical