Cross-site session transfer vulnerability :

It was found that mod_auth_mellon was vulnerable to a cross-site session transfer attack. An attacker with access to one website on a server could use the same session to get access to a different site running on the same server. (CVE-2017-6807)

クロスサイトセッション転送の脆弱性：

mod_auth_mellonがクロスサイトセッション転送攻撃に対して脆弱であることがわかりました。サーバー上の  1 つの Web サイトにアクセスできる攻撃者が同じセッションを使用して、同じサーバー上で実行されている別のサイトにアクセスする可能性があります。(CVE-2017-6807)

リモートのUbuntu 16.04LTSホストには、USN-4597-1のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 0.13.1以前のmod_auth_mellonは、クロスサイトセッション転送攻撃に対して脆弱です。この攻撃では、サーバーで実行されている1つのWebサイトにアクセスできるユーザーが、セッションクッキーを同じサーバー上の別のWebサイトにコピーして、そのサイトへのアクセス権を取得できます。 ( CVE-2017-6807)

  - v0.14.2以前のmod_auth_mellonに脆弱性が見つかりました。ログアウトURLのオープンリダイレクトによって、バックスラッシュを含むリクエストが、相対URLであると仮定されて通過する可能性がありますが、ブラウザーはバックスラッシュ文字を絶対URLとして処理するフォワードスラッシュに警告なしに変換します。この不一致により、攻撃者がapr_uri_parse関数のリダイレクトURL検証ロジックをバイパスする可能性があります。 (CVE-2019-3877)

  - v0.14.2以前のmod_auth_mellonに脆弱性が見つかりました。Apacheがリバースプロキシとして設定されており、mod_auth_mellonが認証されたユーザーのみを通過させるように設定されている場合 (require valid-userディレクティブを使用) 、特別なSAML ECP (非ブラウザーベース) の起動に通常使用される特別なHTTPヘッダーが追加されて、認証がバイパスされる可能性があります。 (CVE-2019-3878)

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4597-1 advisory.

  - mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with     access to one web site running on a server can copy their session cookie to a different web site on the     same server to get access to that site. (CVE-2017-6807)

  - A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows     requests with backslashes to pass through by assuming that it is a relative URL, while the browsers     silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch     allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function. (CVE-2019-3877)

  - A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy     and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user     directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser     based) can be used to bypass authentication. (CVE-2019-3878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

跨網站工作階段傳輸弱點：

據發現，mod_auth_mellon 容易遭受跨網站工作階段傳輸攻擊。擁有某部伺服器上一個網站存取權的攻擊者可利用相同的工作階段，取得在相同伺服器上執行之不同網站的存取權。(CVE-2017-6807)

跨站会话传输漏洞：

据发现，mod_auth_mellon 容易遭受跨站会话传输攻击。拥有某部服务器上一个网站访问权的攻击者可利用相同的会话，取得在相同服务器上执行之不同网站的访问权。(CVE-2017-6807)

远程 Ubuntu 16.04 LTS 主机上安装的程序包受到 USN-4597-1 公告中提及的多个漏洞的影响。

  - mod_auth_mellon 0.13.1 之前版本容易受到跨站会话传输攻击，对服务器上运行的某个网站具有访问权限的用户可借此将其会话 Cookie 复制到相同服务器的不同网站上，从而获取该站点的访问权限。(CVE-2017-6807)

  - 在 mod_auth_mellon v0.14.2 之前版本中发现漏洞，其中注销 URL 的开放重定向允许具有反斜线的请求通过假设它是相对 URL 来通过，而浏览器会默默地将反斜线字符转换为将其视为绝对 URL 的正斜线。此错配可让攻击者在 apr_uri_parse 函数中绕过重定向 URL 验证逻辑。(CVE-2019-3877)

  - 在 mod_auth_mellon v0.14.2 之前版本中发现漏洞。如果 Apache 配置为反向 proxy 而 mod_auth_mellon 配置为仅允许通过经身份验证的用户（利用所需的有效用户指令），添加通常用于启动特殊 SAML ECP（非浏览器型）的特殊 HTTP 标头可用来绕过身份验证。(CVE-2019-3878)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

遠端 Ubuntu 16.04 LTS 主機上安裝的一個套件受到 USN-4597-1 公告中所提及的多個弱點影響。

  - 0.13.1 版之前的 mod_auth_mellon 容易受到跨網站工作階段傳輸攻擊，可存取伺服器上正在執行的一個網站的使用者可將其工作階段 Cookie 複製到相同伺服器上的不同網站，從而取得該網站的存取權。(CVE-2017-6807)

  - 在 mod_auth_mellon v0.14.2 之前版本中發現一個弱點。登出 URL 的開放重新導向允許具有反斜線的要求透過假設它是相對 URL 來通過，而瀏覽器會默默地將反斜線字元轉換為將其視為絕對 URL 的正斜線。此錯誤匹配可讓攻擊者在 apr_uri_parse 函式中繞過重新導向 URL 驗證邏輯。(CVE-2019-3877)

  - 在 mod_auth_mellon v0.14.2 之前版本中發現一個弱點。如果 Apache 設定為反向 proxy，而 mod_auth_mellon 設定為僅允許經驗證的使用者通過 (需要有效的使用者指示詞)，則透過新增通常用來啟動特殊 SAML ECP (非瀏覽器型) 的特殊 HTTP 標頭可繞過驗證。(CVE-2019-3878)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

According to the versions of the mod_auth_mellon package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - mod_auth_mellon before 0.13.1 is vulnerable to a     Cross-Site Session Transfer attack, where a user with     access to one web site running on a server can copy     their session cookie to a different web site on the     same server to get access to that site.(CVE-2017-6807)

  - The am_read_post_data function in mod_auth_mellon     before 0.11.1 does not check if the ap_get_client_block     function returns an error, which allows remote     attackers to cause a denial of service (segmentation     fault and process crash) via a crafted POST     data.(CVE-2016-2145)

  - The am_read_post_data function in mod_auth_mellon     before 0.11.1 does not limit the amount of data read,     which allows remote attackers to cause a denial of     service (worker process crash, web server deadlock, or     memory consumption) via a large amount of POST     data.(CVE-2016-2146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mod_auth_mellon: Cross-site session transfer vulnerability (CVE-2017-6807)

  - The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block     function returns an error, which allows remote attackers to cause a denial of service (segmentation fault     and process crash) via a crafted POST data. (CVE-2016-2145)

  - The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read,     which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or     memory consumption) via a large amount of POST data. (CVE-2016-2146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the version of the mod_auth_mellon package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - mod_auth_mellon before 0.13.1 is vulnerable to a     Cross-Site Session Transfer attack, where a user with     access to one web site running on a server can copy     their session cookie to a different web site on the     same server to get access to that site.(CVE-2017-6807)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mod_auth_mellon: open redirect in logout url when using URLs with backslashes (CVE-2019-3877)

  - The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block     function returns an error, which allows remote attackers to cause a denial of service (segmentation fault     and process crash) via a crafted POST data. (CVE-2016-2145)

  - The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read,     which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or     memory consumption) via a large amount of POST data. (CVE-2016-2146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
107239	Amazon Linux AMI : mod_auth_mellon / mod24_auth_mellon (ALAS-2018-968)	Nessus	Amazon Linux Local Security Checks	2018/3/9	2018/4/18	medium
107239	Amazon Linux AMI：mod_auth_mellon/mod24_auth_mellon (ALAS-2018-968)	Nessus	Amazon Linux Local Security Checks	2018/3/9	2018/4/18	medium
141824	Ubuntu16.04LTS: mod_auth_mellonの脆弱性 (USN-4597-1)	Nessus	Ubuntu Local Security Checks	2020/10/22	2023/10/20	high
141824	Ubuntu 16.04 LTS : mod_auth_mellon vulnerabilities (USN-4597-1)	Nessus	Ubuntu Local Security Checks	2020/10/22	2023/10/20	high
107239	Amazon Linux AMI：mod_auth_mellon / mod24_auth_mellon (ALAS-2018-968)	Nessus	Amazon Linux Local Security Checks	2018/3/9	2018/4/18	medium
107239	Amazon Linux AMI：mod_auth_mellon / mod24_auth_mellon (ALAS-2018-968)	Nessus	Amazon Linux Local Security Checks	2018/3/9	2018/4/18	medium
141824	Ubuntu 16.04 LTS：mod_auth_mellon 漏洞 (USN-4597-1)	Nessus	Ubuntu Local Security Checks	2020/10/22	2023/10/20	high
141824	Ubuntu 16.04 LTS：mod_auth_mellon 弱點 (USN-4597-1)	Nessus	Ubuntu Local Security Checks	2020/10/22	2023/10/20	high
131880	EulerOS 2.0 SP2 : mod_auth_mellon (EulerOS-SA-2019-2388)	Nessus	Huawei Local Security Checks	2019/12/10	2021/1/6	medium
199581	RHEL 7 : mod_auth_mellon (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
132167	EulerOS 2.0 SP3 : mod_auth_mellon (EulerOS-SA-2019-2632)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	medium
199605	RHEL 6 : mod_auth_mellon (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium

偵測

搜尋 Plugin

medium

medium

high

high

medium

medium

high

high

medium

medium

medium

medium