SunOS 5.8_x86: Apache Patch.
Date this patch was last updated by Sun : Apr/23/08

远程主机正在运行的 Apache Web 服务器版本低于 1.3.31。因此，该服务器受到一个访问控制绕过漏洞的影响，这是未能在 big-endian 64 位平台上正确匹配包含 IP 地址但缺少相应网络掩码的“allow”或“deny”规则所致。

Nessus 仅通过查看在目标上运行的 Web 服务器返回的服务器标头便确定存在漏洞。如果目标不是大端 64 位平台，则将此视为一则误报。

遠端主機正在執行的 Apache Web 伺服器是 1.3.31 之前版本。因此會受到一個存取控制繞過弱點影響，這是因為在 big-endian 64 位元平台上，應用程式無法正確比對包含 IP 位址但缺少對應網路遮罩的「allow」或「deny」規則。

Nessus 僅透過查看在目標主機上執行的 Web 伺服器傳回的伺服器標頭來確定此弱點。如果目標主機使用的不是 big-endian 64 位元平台，請將此視為誤報。

The remote host is affected by the vulnerability described in GLSA-200405-22 (Apache 1.3: Multiple vulnerabilities)

    On 64-bit big-endian platforms, mod_access does not properly parse     Allow/Deny rules using IP addresses without a netmask which could result in     failure to match certain IP addresses.
    Terminal escape sequences are not filtered from error logs. This could be     used by an attacker to insert escape sequences into a terminal emulator     vulnerable to escape sequences.
    mod_digest does not properly verify the nonce of a client response by using     a AuthNonce secret. This could permit an attacker to replay the response of     another website. This does not affect mod_auth_digest.
    On certain platforms there is a starvation issue where listening sockets     fails to handle short-lived connection on a rarely-accessed listening     socket. This causes the child to hold the accept mutex and block out new     connections until another connection arrives on the same rarely-accessed     listening socket thus leading to a denial of service.
  Impact :

    These vulnerabilities could lead to attackers bypassing intended access     restrictions, denial of service, and possibly execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

SunOS 5.9_x86: Apache Security Patch.
Date this patch was last updated by Sun : Mar/05/10

New apache packages are available for Slackware 8.1, 9.0, 9.1, and
-current to fix security issues. These include a possible denial-of-service attack as well as the ability to possible pipe shell escapes through Apache's errorlog (which could create an exploit if the error log is read in a terminal program that does not filter such escapes). We recommend that sites running Apache upgrade to the new Apache package.

SunOS 5.9: Apache Security Patch.
Date this patch was last updated by Sun : Mar/05/10

Henning Brauer discovered a programming error in Apache 1.3's mod_access that results in the netmasks in IP address access control rules being interpreted incorrectly on 64-bit, big-endian platforms.
In some cases, this could cause a `deny from' IP address access control rule including a netmask to fail.

The remote host is running a version of Apache web server prior to 1.3.31. It is, therefore, affected by an access control bypass vulnerability due to a failure, on big-endian 64-bit platforms, to properly match 'allow' or 'deny' rules that contain an IP address but lack a corresponding netmask.

Nessus has determined the vulnerability exists only by looking at the Server header returned by the web server running on the target. If the target is not a big-endian 64-bit platform, consider this a false positive.

Four security vulnerabilities were fixed with the 1.3.31 release of Apache. All of these issues have been backported and applied to the provided packages. Thanks to Ralf Engelschall of OpenPKG for providing the patches.

Apache 1.3 prior to 1.3.30 did not filter terminal escape sequences from its error logs. This could make it easier for attackers to insert those sequences into the terminal emulators of administrators viewing the error logs that contain vulnerabilities related to escape sequence handling (CVE-2003-0020).

mod_digest in Apache 1.3 prior to 1.3.31 did not properly verify the nonce of a client response by using an AuthNonce secret. Apache now verifies the nonce returned in the client response to check whether it was issued by itself by means of a 'AuthDigestRealmSeed' secret exposed as an MD5 checksum (CVE-2003-0987).

mod_access in Apache 1.3 prior to 1.3.30, when running on big-endian 64-bit platforms, did not properly parse Allow/Deny rules using IP addresses without a netmask. This could allow a remote attacker to bypass intended access restrictions (CVE-2003-0993).

Apache 1.3 prior to 1.3.30, when using multiple listening sockets on certain platforms, allows a remote attacker to cause a DoS by blocking new connections via a short-lived connection on a rarely-accessed listening socket (CVE-2004-0174). While this particular vulnerability does not affect Linux, we felt it prudent to include the fix.

Update :

Due to the changes in mod_digest.so, mod_perl needed to be rebuilt against the patched Apache packages in order for httpd-perl to properly load the module. The appropriate mod_perl packages have been rebuilt and are now available.

SunOS 5.8: Apache Patch.
Date this patch was last updated by Sun : Apr/24/08

ID	名前	製品	ファミリー	公開日	更新日	深刻度
15483	Solaris 8 (x86) : 116974-07	Nessus	Solaris Local Security Checks	2004/10/17	2021/1/14	critical
14177	Apache < 1.3.31 mod_access IP 地址网络掩码规则绕过	Nessus	Web Servers	2004/7/31	2020/6/12	high
14177	Apache < 1.3.31 mod_access IP 位址網路遮罩規則繞過	Nessus	Web Servers	2004/7/31	2020/6/12	high
14508	GLSA-200405-22 : Apache 1.3: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2004/8/30	2021/1/6	high
13593	Solaris 9 (x86) : 114145-12	Nessus	Solaris Local Security Checks	2004/7/12	2021/1/14	critical
18787	Slackware 8.1 / 9.0 / 9.1 / current : apache (SSA:2004-133-01)	Nessus	Slackware Local Security Checks	2005/7/13	2021/1/14	high
13530	Solaris 9 (sparc) : 113146-13	Nessus	Solaris Local Security Checks	2004/7/12	2021/1/14	critical
18833	FreeBSD : Apache 1.3 IP address access control failure on some 64-bit platforms (09d418db-70fd-11d8-873f-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
14177	Apache < 1.3.31 mod_access IP Address Netmask Rule Bypass	Nessus	Web Servers	2004/7/31	2020/6/12	high
14145	Mandrake Linux Security Advisory : apache-mod_perl (MDKSA-2004:046-1)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	high
15482	Solaris 8 (sparc) : 116973-07	Nessus	Solaris Local Security Checks	2004/10/17	2021/1/14	critical

検出

プラグインの検索

critical

high

high

high

critical

high

critical

high

high

high

critical