Luca Ercoli discovered that the 'htdigest' program did not perform any bounds checking when it copied the 'user' and 'realm' arguments into local buffers. If this program is used in remotely callable CGI scripts, this could be exploited by a remote attacker to execute arbitrary code with the privileges of the CGI script.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

The remote host is missing Security Update 2005-005. This security update contains fixes for the following applications :

  - Apache
  - AppKit
  - AppleScript
  - Bluetooth
  - Directory Services
  - Finder
  - Foundation
  - HelpViewer
  - LDAP
  - libXpm
  - lukemftpd
  - NetInfo
  - ServerAdmin
  - sudo
  - Terminal
  - VPN

These programs have multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the 'htdigest' utilility.  Specifically, a long user-supplied realm will cause an overflow and execution of arbitrary code.  This issue is not considered a local flaw, as the program is not run setuid.  An attacker exploiting this flaw would need to find a vulnerable Apache Web server that was making a call to 'htdigest' via a CGI script.    

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

The remote host appears to be running a version of Apache, an open source web server.  This version of Apache is vulnerable to a flaw in the 'htdigest' utilility.  Specifically, a long user-supplied realm will cause an overflow and execution of arbitrary code.  This issue is not considered a local flaw, as the program is not run setuid.  An attacker exploiting this flaw would need to find a vulnerable Apache Web server that was making a call to 'htdigest' via a CGI script.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN

ID	名前	製品	ファミリー	公開日	更新日	深刻度
20509	Ubuntu 4.10 / 5.04 : apache2 vulnerability (USN-120-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	2005/8/18	2024/5/28	critical
18189	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus	MacOS X Local Security Checks	2005/5/3	2024/5/28	high
2884	Apache htdigest realm Variable Overflow	Nessus Network Monitor	Web Servers	2005/5/6	2019/3/6	medium
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients	2005/5/4	2019/3/6	high
800593	Apache htdigest realm Variable Overflow	Log Correlation Engine	Web Servers			medium
800799	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Log Correlation Engine	Operating System Detection			high

検出

プラグインの検索

high

critical

high

medium

high

medium

high