The remote web server appears to be running a version of Apache that is older than version 1.3.33.

This version is vulnerable to a local buffer overflow in the get_tag() function of the module 'mod_include' when a specially crafted document with malformed server-side includes is requested though an HTTP session.

Successful exploitation can lead to execution of arbitrary code with escalated privileges, but requires that server-side includes (SSI) is enabled.

The remote host is affected by the vulnerability described in GLSA-200411-03 (Apache 1.3: Buffer overflow vulnerability in mod_include)

    A possible buffer overflow exists in the get_tag() function of     mod_include.c.
  Impact :

    If Server Side Includes (SSI) are enabled, a local attacker may be able to     run arbitrary code with the rights of an httpd child process by making use     of a specially crafted document with malformed SSI.
  Workaround :

    There is no known workaround at this time.

リモートWebサーバーは、1.3.33より古いバージョンのApacheを実行しているようです。

このバージョンは、不正な形式のサーバー側インクルードを持つ特別に細工されたドキュメントがHTTPセッションを通じてリクエストされる際に、モジュール「mod_include」のget_tag()関数のローカルバッファオーバーフローに対して脆弱です。

悪用に成功すると、昇格した権限で任意のコードが実行される可能性がありますが、サーバー側インクルード（SSI）を有効にする必要があります。

遠端 Web 伺服器執行的 Apache 版本似乎比 1.3.33 舊。

當透過 HTTP 工作階段要求具有格式錯誤之伺服器端包含的特製文件時，此版本容易受到「mod_include」模組的 get_tag() 函式中本機緩衝區溢位弱點的影響。

若攻擊成功，攻擊者可以更高的權限執行任意程式碼，但這需要啟用伺服器端包含 (SSI)。

远程 Web 服务器运行的 Apache 版本似乎低于 1.3.33。

当通过 HTTP 会话请求包含畸形 server-side includes 的特别构建的文档时，此版本容易受到模块“mod_include”的 get_tag() 函数中一个本地缓冲区溢出漏洞的影响。

成功利用此漏洞可导致以提升的特权执行任意代码，但需要启用 server-side includes (SSI)。

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix a security issue. Apache has been upgraded to version 1.3.33 which fixes a buffer overflow which may allow local users to execute arbitrary code as the apache user. The mod_ssl package has also been upgraded to version 2.8.22_1.3.33.

There is a buffer overflow in a function used by mod_include that may enable a local user to gain privileges of a httpd child. Only users that are able to create SSI documents can take advantage of that vulnerability.

The remote host is missing Security Update 2004-12-02. This security update contains a number of fixes for the following programs :

  - Apache
  - Apache2
  - AppKit
  - Cyrus IMAP
  - HIToolbox
  - Kerberos
  - Postfix
  - PSNormalizer
  - QuickTime Streaming Server
  - Safari
  - Terminal

These programs contain multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

Two vulnerabilities have been identified in the Apache 1.3 webserver :

  - CAN-2004-0940     'Crazy Einstein' has discovered a vulnerability in the     'mod_include' module, which can cause a buffer to be     overflown and could lead to the execution of arbitrary     code.

  - NO VULN ID

    Larry Cashdollar has discovered a potential buffer     overflow in the htpasswd utility, which could be     exploited when user-supplied is passed to the program     via a CGI (or PHP, or ePerl, ...) program.

A possible buffer overflow exists in the get_tag() function of mod_include, and if SSI (Server Side Includes) are enabled, a local attacker may be able to run arbitrary code with the rights of an httpd child process. This could be done with a special HTML document using malformed SSI.

The updated packages have been patched to prevent this problem.

Updated apache and mod_ssl packages that fix various minor security issues and bugs in the Apache Web server are now available for Red Hat Enterprise Linux 2.1.

The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server. The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.

A buffer overflow was discovered in the mod_include module. This flaw could allow a local user who is authorized to create server-side include (SSI) files to gain the privileges of a httpd child (user 'apache'). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0940 to this issue.

The mod_digest module does not properly verify the nonce of a client response by using a AuthNonce secret. This could allow a malicious user who is able to sniff network traffic to conduct a replay attack against a website using Digest protection. Note that mod_digest implements an older version of the MD5 Digest Authentication specification, which is known not to work with modern browsers. This issue does not affect mod_auth_digest. (CVE-2003-0987).

An issue has been discovered in the mod_ssl module when configured to use the 'SSLCipherSuite' directive in a directory or location context.
If a particular location context has been configured to require a specific set of cipher suites, then a client is able to access that location using any cipher suite allowed by the virtual host configuration. (CVE-2004-0885).

Several bugs in mod_ssl were also discovered, including :

  - memory leaks in SSL variable handling

  - possible crashes in the dbm and shmht session caches

Red Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade to these erratum packages, which contains Apache version 1.3.27 with backported patches correcting these issues.

The remote host is missing Security Update 2004-12-02. This security update contains a number of enhancements for the following programs :

 - Apache
 - Apache2
 - AppKit
 - Cyrus IMAP
 - HIToolbox
 - Kerberos
 - Postfix
 - PSNormalizer
 - QuickTime Streaming Server
 - Safari
 - Terminal

ID	名稱	產品	系列	已發布	已更新	嚴重性
15554	Apache mod_include get_tag() Function Local Overflow	Nessus	Web Servers	2004/10/25	2020/6/12	medium
15606	GLSA-200411-03 : Apache 1.3: Buffer overflow vulnerability in mod_include	Nessus	Gentoo Local Security Checks	2004/11/2	2021/1/6	medium
15554	Apache mod_include get_tag()関数のローカルオーバーフロー	Nessus	Web Servers	2004/10/25	2020/6/12	medium
15554	Apache mod_include get_tag() 函式本機溢位弱點	Nessus	Web Servers	2004/10/25	2020/6/12	medium
15554	Apache mod_include get_tag() 函数本地溢出	Nessus	Web Servers	2004/10/25	2020/6/12	medium
18788	Slackware 10.0 / 8.1 / 9.0 / 9.1 / current : apache+mod_ssl (SSA:2004-305-01)	Nessus	Slackware Local Security Checks	2005/7/13	2021/1/14	medium
37841	FreeBSD : apache mod_include buffer overflow vulnerability (6e6a6b8a-2fde-11d9-b3a2-0050fc56d258)	Nessus	FreeBSD Local Security Checks	2009/4/23	2021/1/6	medium
15898	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus	MacOS X Local Security Checks	2004/12/2	2024/5/28	high
15729	Debian DSA-594-1 : apache - buffer overflows	Nessus	Debian Local Security Checks	2004/11/17	2021/1/4	medium
15739	Mandrake Linux Security Advisory : apache (MDKSA-2004:134)	Nessus	Mandriva Local Security Checks	2004/11/17	2021/1/6	medium
15960	RHEL 2.1 : apache, mod_ssl (RHSA-2004:600)	Nessus	Red Hat Local Security Checks	2004/12/14	2021/1/14	high
2444	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus Network Monitor	Web Clients	2004/12/4	2019/3/6	high
800800	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Log Correlation Engine	Operating System Detection			medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high

high

medium