The remote host is missing Security Update 2004-12-02. This security update contains a number of fixes for the following programs :

  - Apache
  - Apache2
  - AppKit
  - Cyrus IMAP
  - HIToolbox
  - Kerberos
  - Postfix
  - PSNormalizer
  - QuickTime Streaming Server
  - Safari
  - Terminal

These programs contain multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

According to its Server response header, the remote host is running a version of Apache 2.0.x prior to 2.0.51. It is, therefore, affected by multiple vulnerabilities :

  - An input validation issue in apr-util can be triggered     by malformed IPv6 literal addresses and result in a     buffer overflow (CVE-2004-0786).

  - There is a buffer overflow that can be triggered when     expanding environment variables during configuration     file parsing (CVE-2004-0747).

  - A segfault in mod_dav_ds when handling an indirect lock     refresh can lead to a process crash (CVE-2004-0809).

  - A segfault in the SSL input filter can be triggered     if using 'speculative' mode by, for instance, a proxy     request to an SSL server (CVE-2004-0751).

  - There is the potential for an infinite loop in mod_ssl     (CVE-2004-0748).

Updated httpd packages that include fixes for security issues are now available.

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server.

Four issues have been discovered affecting releases of the Apache HTTP 2.0 Server, up to and including version 2.0.50 :

Testing using the Codenomicon HTTP Test Tool performed by the Apache Software Foundation security group and Red Hat uncovered an input validation issue in the IPv6 URI parsing routines in the apr-util library. If a remote attacker sent a request including a carefully crafted URI, an httpd child process could be made to crash. This issue is not believed to allow arbitrary code execution on Red Hat Enterprise Linux. This issue also does not represent a significant denial of service attack as requests will continue to be handled by other Apache child processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0786 to this issue.

The Swedish IT Incident Centre (SITIC) reported a buffer overflow in the expansion of environment variables during configuration file parsing. This issue could allow a local user to gain 'apache' privileges if an httpd process can be forced to parse a carefully crafted .htaccess file written by a local user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0747 to this issue.

An issue was discovered in the mod_ssl module which could be triggered if the server is configured to allow proxying to a remote SSL server.
A malicious remote SSL server could force an httpd child process to crash by sending a carefully crafted response header. This issue is not believed to allow execution of arbitrary code. This issue also does not represent a significant Denial of Service attack as requests will continue to be handled by other Apache child processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0751 to this issue.

An issue was discovered in the mod_dav module which could be triggered for a location where WebDAV authoring access has been configured. A malicious remote client which is authorized to use the LOCK method could force an httpd child process to crash by sending a particular sequence of LOCK requests. This issue does not allow execution of arbitrary code. This issue also does not represent a significant Denial of Service attack as requests will continue to be handled by other Apache child processes. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0809 to this issue.

Users of the Apache HTTP server should upgrade to these updated packages, which contain backported patches that address these issues.

サーバー応答ヘッダーによると、リモートホストは、2.0.51 より古いバージョンの Apache 2.0 を実行しています。このようなバージョンは、以下を含むいくつかの問題の影響を受けることがあります。

  - apr-util の入力検証問題は、不正な形式の IPv6 リテラルアドレスによってトリガされ、バッファオーバーフローを引き起こすことがあります（CVE-2004-0786）。

  - 構成ファイルの構文解析中に環境変数を展開するとトリガされることがあるバッファオーバーフローがあります (CVE-2004-0747)。

  - 間接的なロックの更新を処理する際の mod_dav_ds のセグメンテーション違反により、プロセスがクラッシュすることがあります（CVE-2004-0809）。

  - 例えば、SSL サーバーへのプロキシ要求によって「推測」モードを使用している場合、SSL の入力フィルタのセグメンテーション違反がトリガされることがあります（CVE-2004-0751）。

  - mod_ssl で無限ループの可能性があります（CVE-2004-0748）。

根据其服务器响应头，远程主机正在运行版本低于 2.0.51 的 Apache 2.0.x。因此，该服务器受到多个漏洞的影响：

  - apr-util 中可由畸形 IPv6 文本地址触发的输入有效性问题，可导致缓冲区溢出 (CVE-2004-0786)。

  - 可在配置文件解析期间扩展环境变量时触发的缓冲区溢出 (CVE-2004-0747)。

  - 处理间接锁定刷新时 mod_dav_ds 中的段错误，可导致进程崩溃 (CVE-2004-0809)。

  - 如果使用“推理”模式，可由对 SSL 服务器的代理请求等触发的 SSL 输入筛选器中的段错误 (CVE-2004-0751)。

  - mod_ssl 中可能出现无限循环 (CVE-2004-0748)。

根據伺服器回應標頭來判斷，遠端主機正在執行 Apache 2.0.x 的 2.0.51 之前版本。因此，該應用程式受到多個弱點影響：

  - apr-util 中存在輸入驗證問題，由格式錯誤的 IPv6 常值位址觸發后，會導致緩衝區溢位 (CVE-2004-0786)。

  - 存在緩衝區溢位，在設定檔案剖析期間擴大環境變數后會觸發 (CVE-2004-0747)。

  - mod_dav_ds 在處理間接鎖定重新整理時會發生分割錯誤，可導致處理程序損毀 (CVE-2004-0809)。

  - 在假設由向 SSL 伺服器提出要求的 proxy 使用「speculative」模式的情況下，可以觸發 SSL 輸出篩選中的分割錯誤 (CVE-2004-0751)。

  - mod_ssl 中存在潛在的無限迴圈 (CVE-2004-0748)。

SITIC discovered a vulnerability in Apache 2's handling of environmental variable settings in the httpd configuration files (the main `httpd.conf' and `.htaccess' files). According to a SITIC advisory :

The buffer overflow occurs when expanding ${ENVVAR} constructs in .htaccess or httpd.conf files. The function ap_resolve_env() in server/util.c copies data from environment variables to the character array tmp with strcat(3), leading to a buffer overflow.

Two Denial of Service conditions were discovered in the input filter of mod_ssl, the module that enables apache to handle HTTPS requests.

Another vulnerability was discovered by the ASF security team using the Codenomicon HTTP Test Tool. This vulnerability, in the apr-util library, can possibly lead to arbitrary code execution if certain non-default conditions are met (enabling the AP_ENABLE_EXCEPTION_HOOK define).

As well, the SITIC have discovered a buffer overflow when Apache expands environment variables in configuration files such as .htaccess and httpd.conf, which can lead to possible privilege escalation. This can only be done, however, if an attacker is able to place malicious configuration files on the server.

Finally, a crash condition was discovered in the mod_dav module by Julian Reschke, where sending a LOCK refresh request to an indirectly locked resource could crash the server.

The updated packages have been patched to protect against these vulnerabilities.

The remote host is missing the patch for the advisory SUSE-SA:2004:032 (apache2).


The Apache daemon is running on most of the web-servers used in the Internet today.
The Red Hat ASF Security-Team and the Swedish IT Incident Center within the National Post and Telecom Agency (SITIC) have found a bug in apache2 each.
The first vulnerability appears in the apr_uri_parse() function while handling IPv6 addresses. The affected code passes a negative length argument to the memcpy() function. On BSD systems this can lead to remote command execution due to the nature of the memcpy() implementation.
On Linux this bug will result in a remote denial-of-service condition.
The second bug is a local buffer overflow that occurs while expanding ${ENVVAR} in the .htaccess and httpd.conf file. Both files are not writeable by normal user by default.

The remote host is affected by the vulnerability described in GLSA-200409-21 (Apache 2, mod_dav: Multiple vulnerabilities)

    A potential infinite loop has been found in the input filter of mod_ssl     (CAN-2004-0748) as well as a possible segmentation fault in the     char_buffer_read function if reverse proxying to a SSL server is being used     (CAN-2004-0751). Furthermore, mod_dav, as shipped in Apache httpd 2 or     mod_dav 1.0.x for Apache 1.3, contains a NULL pointer dereference which can     be triggered remotely (CAN-2004-0809). The third issue is an input     validation error found in the IPv6 URI parsing routines within the apr-util     library (CAN-2004-0786). Additionally a possible buffer overflow has been     reported when expanding environment variables during the parsing of     configuration files (CAN-2004-0747).
  Impact :

    A remote attacker could cause a Denial of Service either by aborting a SSL     connection in a special way, resulting in CPU consumption, by exploiting     the segmentation fault in mod_ssl or the mod_dav flaw. A remote attacker     could also crash a httpd child process by sending a specially crafted URI.
    The last vulnerability could be used by a local user to gain the privileges     of a httpd child, if the server parses a carefully prepared .htaccess file.
  Workaround :

    There is no known workaround at this time.

The remote host is running a vulnerable version of Apache. It is reported that versions prior 2.0.51 are prone to a local buffer overflow when processing ${ENVVAR} constructs in .htaccess and httpd.conf files. An attacker with interactive access to the computer may use this flaw to execute arbitrary code in the context of the web server.

The remote host is running a vulnerable version of Apache. It is reported that versions prior to 2.0.51 are prone to a remote buffer overflow when parsing an URI sent over IPv6. An attacker may use this vulnerability to execute arbitrary code on the remote host or to deny service to legitimate users.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
15898	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus	MacOS X Local Security Checks	2004/12/2	2024/5/28	high
14748	Apache 2.0.x < 2.0.51 Multiple Vulnerabilities (OF, DoS)	Nessus	Web Servers	2004/9/16	2018/11/15	medium
14736	RHEL 3 : httpd (RHSA-2004:463)	Nessus	Red Hat Local Security Checks	2004/9/15	2021/1/14	medium
14748	Apache < 2.0.51 の複数の脆弱性（OF、DoS）	Nessus	Web Servers	2004/9/16	2018/11/15	medium
14748	Apache 2.0.x < 2.0.51 多个漏洞（OF、DoS）	Nessus	Web Servers	2004/9/16	2018/11/15	medium
14748	Apache 2.0.x < 2.0.51多個弱點 (OF、DoS)	Nessus	Web Servers	2004/9/16	2018/11/15	medium
36910	FreeBSD : apache -- ap_resolve_env buffer overflow (4d49f4ba-071f-11d9-b45d-000c41e2cdad)	Nessus	FreeBSD Local Security Checks	2009/4/23	2021/1/6	medium
14752	Mandrake Linux Security Advisory : apache2 (MDKSA-2004:096)	Nessus	Mandriva Local Security Checks	2004/9/16	2021/1/6	high
14731	SUSE-SA:2004:032: apache2	Nessus	SuSE Local Security Checks	2004/9/15	2021/1/14	medium
14766	GLSA-200409-21 : Apache 2, mod_dav: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2004/9/17	2021/1/6	medium
2290	Apache < 2.0.51 ${ENVVAR} Local Overflow	Nessus Network Monitor	Web Servers	2004/9/15	2019/3/6	medium
2292	Apache < 2.0.51 IPv6 Remote Buffer Overflow	Nessus Network Monitor	Web Servers	2004/9/15	2019/3/6	medium
800562	Apache < 2.0.51 ${ENVVAR} Local Overflow	Log Correlation Engine	Web Servers			medium

検出

プラグインの検索

high

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium