5 - GLSA-200807-06

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	Apache: Denial of Service

Informations
Name	GLSA-200807-06	First vendor Publication	2008-07-09
Vendor	Gentoo	Last vendor Modification	2008-07-09
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities in Apache might lead to a Denial of Service.

Background

The Apache HTTP server is one of the most popular web servers on the Internet.

Description

Multiple vulnerabilities have been discovered in Apache:

* Dustin Kirkland reported that the mod_ssl module can leak memory when the client reports support for a compression algorithm (CVE-2008-1678).

* Ryujiro Shibuya reported that the ap_proxy_http_process_response()
function in the mod_proxy module does not limit the number of forwarded interim responses (CVE-2008-2364).

* sp3x of SecurityReason reported a Cross-Site Request Forgery vulnerability in the balancer-manager in the mod_proxy_balancer module (CVE-2007-6420).

Impact

A remote attacker could exploit these vulnerabilities by connecting to an Apache httpd, by causing an Apache proxy server to connect to a malicious server, or by enticing a balancer administrator to connect to a specially-crafted URL, resulting in a Denial of Service of the Apache daemon.

Workaround

There is no known workaround at this time.

Resolution

All Apache users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/apache-2.2.9"

References

[ 1 ] CVE-2007-6420 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6420
[ 2 ] CVE-2008-1678 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1678
[ 3 ] CVE-2008-2364 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2364

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200807-06.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200807-06.xml

CWE : Common Weakness Enumeration

%	Id	Name
33 %	CWE-770	Allocation of Resources Without Limits or Throttling
33 %	CWE-399	Resource Management Errors
33 %	CWE-352	Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11713

Oval ID:	oval:org.mitre.oval:def:11713
Title:	Apache 'mod_proxy_http' Interim Response Denial of Service Vulnerability
Description:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2008-2364	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Apache
Definition Synopsis:
IF Apache HTTP Server 2.0.x is installed on the system AND The version of libhttpd.dll is less than 2.0.64 OR Apache HTTP Server 2.2.x is installed on the system AND The version of libhttpd.dll is less than 2.2.9

Definition Id: oval:org.mitre.oval:def:6084

Oval ID:	oval:org.mitre.oval:def:6084
Title:	HP-UX Running Apache, Remote Cross Site Scripting (XSS) or Denial of Service (DoS)
Description:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2364	Version:	9
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02365 HP Release B.11.11 AND filesets tests hpuxwsAPACHE.PHP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.PHP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.0.59.07.01 OR Criteria meets HP Security Bulletin HPSBUX02365 platforms HP-UX B.11.31 AND HP Release B.11.23 AND filesets tests hpuxwsAPCH32.PHP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE2 version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.PHP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.AUTH_LDAP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.APACHE version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.APACHE2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_JK2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.AUTH_LDAP version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.AUTH_LDAP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.MOD_PERL2 version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_JK version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.PHP version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_JK2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.PHP2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.WEBPROXY version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_PERL version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.WEBPROXY version is less than B.2.0.59.07.01 AND hpuxwsAPCH32.MOD_PERL2 version is less than B.2.0.59.07.01 AND hpuxwsAPACHE.APACHE version is less than B.2.0.59.07.01

Definition Id: oval:org.mitre.oval:def:8371

Oval ID:	oval:org.mitre.oval:def:8371
Title:	Apache 'mod_proxy_balancer' Cross-Site Request Forgery (CSRF) Vulnerability
Description:	Cross-site request forgery (CSRF) vulnerability in the balancer-manager in mod_proxy_balancer for Apache HTTP Server 2.2.x allows remote attackers to gain privileges via unspecified vectors.
Family:	windows	Class:	vulnerability
Reference(s):	CVE-2007-6420	Version:	7
Platform(s):	Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows 7	Product(s):	Apache
Definition Synopsis:
Apache HTTP Server 2.2.x is installed on the system AND The version of libhttpd.dll is less than 2.2.9

Definition Id: oval:org.mitre.oval:def:9577

Oval ID:	oval:org.mitre.oval:def:9577
Title:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Description:	The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2364	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section httpd-devel is earlier than 0:2.0.46-71.ent AND mod_ssl is earlier than 0:2.0.46-71.ent AND httpd is earlier than 0:2.0.46-71.ent OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section httpd-suexec is earlier than 0:2.0.52-41.ent.2 AND httpd-manual is earlier than 0:2.0.52-41.ent.2 AND httpd-devel is earlier than 0:2.0.52-41.ent.2 AND mod_ssl is earlier than 0:2.0.52-41.ent.2 AND httpd is earlier than 0:2.0.52-41.ent.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section httpd-manual is earlier than 0:2.2.3-11.el5_2.4 AND httpd-devel is earlier than 0:2.2.3-11.el5_2.4 AND mod_ssl is earlier than 0:2.2.3-11.el5_2.4 AND httpd is earlier than 0:2.2.3-11.el5_2.4

Definition Id: oval:org.mitre.oval:def:9754

Oval ID:	oval:org.mitre.oval:def:9754
Title:	Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
Description:	Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-1678	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section httpd-manual is earlier than 0:2.2.3-22.el5_3.1 AND httpd-devel is earlier than 0:2.2.3-22.el5_3.1 AND mod_ssl is earlier than 0:2.2.3-22.el5_3.1 AND httpd is earlier than 0:2.2.3-22.el5_3.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Http Server cpe:2.3:a:apache:http_server:2.2.8:::::::* cpe:2.3:a:apache:http_server:2.2.7:::::::* cpe:2.3:a:apache:http_server:2.2.6:::::::* cpe:2.3:a:apache:http_server:2.2.5:::::::* cpe:2.3:a:apache:http_server:2.2.4:::::::* cpe:2.3:a:apache:http_server:2.2.3:::::::* cpe:2.3:a:apache:http_server:2.2.3::windows::::: cpe:2.3:a:apache:http_server:2.2.2:::::::* cpe:2.3:a:apache:http_server:2.2.2::windows::::: cpe:2.3:a:apache:http_server:2.2.1:::::::* cpe:2.3:a:apache:http_server:2.2.0:::::::* cpe:2.3:a:apache:http_server:2.2:::::::* cpe:2.3:a:apache:http_server:2.1.9:::::::* cpe:2.3:a:apache:http_server:2.1.8:::::::* cpe:2.3:a:apache:http_server:2.1.7:::::::* cpe:2.3:a:apache:http_server:2.1.6:::::::* cpe:2.3:a:apache:http_server:2.1.5:::::::* cpe:2.3:a:apache:http_server:2.1.4:::::::* cpe:2.3:a:apache:http_server:2.1.3:::::::* cpe:2.3:a:apache:http_server:2.1.2:::::::* cpe:2.3:a:apache:http_server:2.1.1:::::::* cpe:2.3:a:apache:http_server:2.1.0:::::::* cpe:2.3:a:apache:http_server:2.1:::::::* cpe:2.3:a:apache:http_server:2.0.9:::::::* cpe:2.3:a:apache:http_server:2.0.65:::::::* cpe:2.3:a:apache:http_server:2.0.64:::::::* cpe:2.3:a:apache:http_server:2.0.63:::::::* cpe:2.3:a:apache:http_server:2.0.61:::::::* cpe:2.3:a:apache:http_server:2.0.60:::::::* cpe:2.3:a:apache:http_server:2.0.59:::::::* cpe:2.3:a:apache:http_server:2.0.58:::::::* cpe:2.3:a:apache:http_server:2.0.58::win32::::: cpe:2.3:a:apache:http_server:2.0.57:::::::* cpe:2.3:a:apache:http_server:2.0.56:::::::* cpe:2.3:a:apache:http_server:2.0.55:::::::* cpe:2.3:a:apache:http_server:2.0.54:::::::* cpe:2.3:a:apache:http_server:2.0.53:::::::* cpe:2.3:a:apache:http_server:2.0.52:::::::* cpe:2.3:a:apache:http_server:2.0.51:::::::* cpe:2.3:a:apache:http_server:2.0.50:::::::* cpe:2.3:a:apache:http_server:2.0.49:::::::* cpe:2.3:a:apache:http_server:2.0.48:::::::* cpe:2.3:a:apache:http_server:2.0.47:::::::* cpe:2.3:a:apache:http_server:2.0.46:::::::* cpe:2.3:a:apache:http_server:2.0.46::win32::::: cpe:2.3:a:apache:http_server:2.0.45:::::::* cpe:2.3:a:apache:http_server:2.0.44:::::::* cpe:2.3:a:apache:http_server:2.0.43:::::::* cpe:2.3:a:apache:http_server:2.0.42:::::::* cpe:2.3:a:apache:http_server:2.0.41:::::::* cpe:2.3:a:apache:http_server:2.0.40:::::::* cpe:2.3:a:apache:http_server:2.0.39:::::::* cpe:2.3:a:apache:http_server:2.0.38:::::::* cpe:2.3:a:apache:http_server:2.0.37:::::::* cpe:2.3:a:apache:http_server:2.0.36:::::::* cpe:2.3:a:apache:http_server:2.0.35:::::::* cpe:2.3:a:apache:http_server:2.0.34:beta:::::: cpe:2.3:a:apache:http_server:2.0.34:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.34:::::::* cpe:2.3:a:apache:http_server:2.0.33:::::::* cpe:2.3:a:apache:http_server:2.0.32:beta:::::: cpe:2.3:a:apache:http_server:2.0.32:::::::* cpe:2.3:a:apache:http_server:2.0.32:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.31:::::::* cpe:2.3:a:apache:http_server:2.0.30:::::::* cpe:2.3:a:apache:http_server:2.0.29:::::::* cpe:2.3:a:apache:http_server:2.0.28:beta:::::: cpe:2.3:a:apache:http_server:2.0.28:::::::* cpe:2.3:a:apache:http_server:2.0.28:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.27:::::::* cpe:2.3:a:apache:http_server:2.0.26:::::::* cpe:2.3:a:apache:http_server:2.0.25:::::::* cpe:2.3:a:apache:http_server:2.0.24:::::::* cpe:2.3:a:apache:http_server:2.0.23:::::::* cpe:2.3:a:apache:http_server:2.0.22:::::::* cpe:2.3:a:apache:http_server:2.0.21:::::::* cpe:2.3:a:apache:http_server:2.0.20:::::::* cpe:2.3:a:apache:http_server:2.0.19:::::::* cpe:2.3:a:apache:http_server:2.0.18:::::::* cpe:2.3:a:apache:http_server:2.0.17:::::::* cpe:2.3:a:apache:http_server:2.0.16:::::::* cpe:2.3:a:apache:http_server:2.0.15:::::::* cpe:2.3:a:apache:http_server:2.0.14:::::::* cpe:2.3:a:apache:http_server:2.0.13:::::::* cpe:2.3:a:apache:http_server:2.0.12:::::::* cpe:2.3:a:apache:http_server:2.0.11:::::::* cpe:2.3:a:apache:http_server:2.0.0:::::::* cpe:2.3:a:apache:http_server:2.0:::::::* cpe:2.3:a:apache:http_server:2.0:alpha9:::::: cpe:2.3:a:apache:http_server:1.99:::::::* cpe:2.3:a:apache:http_server:1.4.0:::::::* cpe:2.3:a:apache:http_server:1.3.9:::::::* cpe:2.3:a:apache:http_server:1.3.9::win32::::: cpe:2.3:a:apache:http_server:1.3.8:::::::* cpe:2.3:a:apache:http_server:1.3.7:::::::* cpe:2.3:a:apache:http_server:1.3.7::dev::::: cpe:2.3:a:apache:http_server:1.3.68:::::::* cpe:2.3:a:apache:http_server:1.3.65:::::::* cpe:2.3:a:apache:http_server:1.3.6:::::::* cpe:2.3:a:apache:http_server:1.3.6::win32::::: cpe:2.3:a:apache:http_server:1.3.5:::::::* cpe:2.3:a:apache:http_server:1.3.42:::::::* cpe:2.3:a:apache:http_server:1.3.41:::::::* cpe:2.3:a:apache:http_server:1.3.40:::::::* cpe:2.3:a:apache:http_server:1.3.4:::::::* cpe:2.3:a:apache:http_server:1.3.39:::::::* cpe:2.3:a:apache:http_server:1.3.38:::::::* cpe:2.3:a:apache:http_server:1.3.37:::::::* cpe:2.3:a:apache:http_server:1.3.36:::::::* cpe:2.3:a:apache:http_server:1.3.35:::::::* cpe:2.3:a:apache:http_server:1.3.34:::::::* cpe:2.3:a:apache:http_server:1.3.33:::::::* cpe:2.3:a:apache:http_server:1.3.32:::::::* cpe:2.3:a:apache:http_server:1.3.31:::::::* cpe:2.3:a:apache:http_server:1.3.30:::::::* cpe:2.3:a:apache:http_server:1.3.3:::::::* cpe:2.3:a:apache:http_server:1.3.29:::::::* cpe:2.3:a:apache:http_server:1.3.28:::::::* cpe:2.3:a:apache:http_server:1.3.27:::::::* cpe:2.3:a:apache:http_server:1.3.26:::::::* cpe:2.3:a:apache:http_server:1.3.26::win32::::: cpe:2.3:a:apache:http_server:1.3.25:::::::* cpe:2.3:a:apache:http_server:1.3.25::win32::::: cpe:2.3:a:apache:http_server:1.3.24:::::::* cpe:2.3:a:apache:http_server:1.3.24::win32::::: cpe:2.3:a:apache:http_server:1.3.23:::::::* cpe:2.3:a:apache:http_server:1.3.23::win32::::: cpe:2.3:a:apache:http_server:1.3.22:::::::* cpe:2.3:a:apache:http_server:1.3.22::win32::::: cpe:2.3:a:apache:http_server:1.3.20:::::::* cpe:2.3:a:apache:http_server:1.3.20::win32::::: cpe:2.3:a:apache:http_server:1.3.2:::::::* cpe:2.3:a:apache:http_server:1.3.19:::::::* cpe:2.3:a:apache:http_server:1.3.19::win32::::: cpe:2.3:a:apache:http_server:1.3.18:::::::* cpe:2.3:a:apache:http_server:1.3.18::win32::::: cpe:2.3:a:apache:http_server:1.3.17:::::::* cpe:2.3:a:apache:http_server:1.3.17::win32::::: cpe:2.3:a:apache:http_server:1.3.16:::::::* cpe:2.3:a:apache:http_server:1.3.16::win32::::: cpe:2.3:a:apache:http_server:1.3.15:::::::* cpe:2.3:a:apache:http_server:1.3.15::win32::::: cpe:2.3:a:apache:http_server:1.3.14:::::::* cpe:2.3:a:apache:http_server:1.3.14::win32::::: cpe:2.3:a:apache:http_server:1.3.14::mac_os::::: cpe:2.3:a:apache:http_server:1.3.13:::::::* cpe:2.3:a:apache:http_server:1.3.13::win32::::: cpe:2.3:a:apache:http_server:1.3.12:::::::* cpe:2.3:a:apache:http_server:1.3.12::win32::::: cpe:2.3:a:apache:http_server:1.3.11:::::::* cpe:2.3:a:apache:http_server:1.3.11::win32::::: cpe:2.3:a:apache:http_server:1.3.10:::::::* cpe:2.3:a:apache:http_server:1.3.1.1:::::::* cpe:2.3:a:apache:http_server:1.3.1:::::::* cpe:2.3:a:apache:http_server:1.3.0:::::::* cpe:2.3:a:apache:http_server:1.3:::::::* cpe:2.3:a:apache:http_server:1.2.9:::::::* cpe:2.3:a:apache:http_server:1.2.6:::::::* cpe:2.3:a:apache:http_server:1.2.5:::::::* cpe:2.3:a:apache:http_server:1.2.4:::::::* cpe:2.3:a:apache:http_server:1.2.0:::::::* cpe:2.3:a:apache:http_server:1.15.17:::::::* cpe:2.3:a:apache:http_server:1.1.1:::::::* cpe:2.3:a:apache:http_server:1.1:::::::* cpe:2.3:a:apache:http_server:1.0.5:::::::* cpe:2.3:a:apache:http_server:1.0.3:::::::* cpe:2.3:a:apache:http_server:1.0.2:::::::* cpe:2.3:a:apache:http_server:1.0:::::::* cpe:2.3:a:apache:http_server:0.8.14:::::::* cpe:2.3:a:apache:http_server:0.8.11:::::::* cpe:2.3:a:apache:http_server:::::::: cpe:2.3:a:apache:http_server:::win32:::::* cpe:2.3:a:apache:http_server:-:::::::*	173
Application	Openssl cpe:2.3:a:openssl:openssl:0.9.8h:::::::* cpe:2.3:a:openssl:openssl:0.9.8g:::::::* cpe:2.3:a:openssl:openssl:0.9.8f:::::::*	3
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:8.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:8.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:7.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*	4
Os	Fedoraproject Fedora cpe:2.3:o:fedoraproject:fedora:9:::::::* cpe:2.3:o:fedoraproject:fedora:8:::::::*	2
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*	3
Os	Redhat Enterprise Linux Eus cpe:2.3:o:redhat:enterprise_linux_eus:5.2:::::::* cpe:2.3:o:redhat:enterprise_linux_eus:4.7:::::::*	2
Os	Redhat Enterprise Linux Server cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::* cpe:2.3:o:redhat:enterprise_linux_server:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_server:3.0:::::::*	3
Os	Redhat Enterprise Linux Workstation cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::* cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:::::::*	3

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for httpd CESA-2009:1075 centos5 i386 File : nvt/gb_CESA-2009_1075_httpd_centos5_i386.nasl
2010-05-12	Name : Mac OS X Security Update 2008-007 File : nvt/macosx_secupd_2008-007.nasl
2010-01-22	Name : Mandriva Update for openssl MDVSA-2010:022 (openssl) File : nvt/gb_mandriva_MDVSA_2010_022.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:323 (apache) File : nvt/mdksa_2009_323.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-22	Name : HP-UX Update for Apache-based Web Server HPSBUX02465 File : nvt/gb_hp_ux_HPSBUX02465.nasl
2009-10-13	Name : SLES10: Security update for Apache 2 File : nvt/sles10_apache20.nasl
2009-10-13	Name : SLES10: Security update for Apache 2 File : nvt/sles10_apache2.nasl
2009-07-15	Name : Mandrake Security Advisory MDVSA-2009:124-1 (apache) File : nvt/mdksa_2009_124_1.nasl
2009-06-05	Name : RedHat Security Advisory RHSA-2009:1075 File : nvt/RHSA_2009_1075.nasl
2009-06-05	Name : Mandrake Security Advisory MDVSA-2009:124 (apache) File : nvt/mdksa_2009_124.nasl
2009-06-05	Name : CentOS Security Advisory CESA-2009:1075 (httpd) File : nvt/ovcesa2009_1075.nasl
2009-06-05	Name : Ubuntu USN-719-1 (libpam-krb5) File : nvt/ubuntu_719_1.nasl
2009-06-05	Name : Ubuntu USN-720-1 (php5) File : nvt/ubuntu_720_1.nasl
2009-06-03	Name : Solaris Update for Apache 2 120543-14 File : nvt/gb_solaris_120543_14.nasl
2009-06-03	Name : Solaris Update for Apache 2 120544-14 File : nvt/gb_solaris_120544_14.nasl
2009-05-05	Name : HP-UX Update for Apache HPSBUX02365 File : nvt/gb_hp_ux_HPSBUX02365.nasl
2009-05-05	Name : HP-UX Update for Apache Web Server Suite HPSBUX02401 File : nvt/gb_hp_ux_HPSBUX02401.nasl
2009-04-09	Name : Mandriva Update for apache MDVSA-2008:195 (apache) File : nvt/gb_mandriva_MDVSA_2008_195.nasl
2009-03-31	Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl
2009-03-13	Name : SuSE Security Summary SUSE-SR:2009:006 File : nvt/suse_sr_2009_006.nasl
2009-03-13	Name : Ubuntu USN-731-1 (apache2) File : nvt/ubuntu_731_1.nasl
2009-03-06	Name : RedHat Update for httpd RHSA-2008:0967-01 File : nvt/gb_RHSA-2008_0967-01_httpd.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos4 x86_64 File : nvt/gb_CESA-2008_0967_httpd_centos4_x86_64.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos4 i386 File : nvt/gb_CESA-2008_0967_httpd_centos4_i386.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos3 x86_64 File : nvt/gb_CESA-2008_0967_httpd_centos3_x86_64.nasl
2009-02-27	Name : CentOS Update for httpd CESA-2008:0967 centos3 i386 File : nvt/gb_CESA-2008_0967_httpd_centos3_i386.nasl
2009-02-17	Name : Fedora Update for httpd FEDORA-2008-6393 File : nvt/gb_fedora_2008_6393_httpd_fc9.nasl
2009-02-17	Name : Fedora Update for httpd FEDORA-2008-6314 File : nvt/gb_fedora_2008_6314_httpd_fc8.nasl
2008-09-25	Name : IBM HTTP Server mod_proxy Interim Responses DoS Vulnerability File : nvt/secpod_ibmhttpserver_mod_proxy_dos_900222.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200807-06 (apache) File : nvt/glsa_200807_06.nasl
2008-09-04	Name : FreeBSD Ports: apache File : nvt/freebsd_apache13.nasl
0000-00-00	Name : Slackware Advisory SSA:2010-060-02 openssl File : nvt/esoft_slk_ssa_2010_060_02.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
47810	OpenSSL libssl crypto/comp/c_zlib.c zlib_stateful_init Function Memory Exhaus...
46085	Apache HTTP Server mod_proxy ap_proxy_http_process_response() Function Interi...
42937	Apache HTTP Server mod_proxy_balancer balancer-manager Unspecified CSRF

Nessus® Vulnerability Scanner

Date	Description
2013-08-11	Name : The remote web server may be affected by multiple vulnerabilities. File : oracle_http_server_cpu_jul_2013.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1075.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090527_httpd_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20081111_httpd_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2010-10-20	Name : The remote web server is affected by multiple vulnerabilities. File : apache_2_0_64.nasl - Type : ACT_GATHER_INFO
2010-03-11	Name : The remote web server has multiple SSL-related vulnerabilities. File : openssl_0_9_8m.nasl - Type : ACT_GATHER_INFO
2010-03-02	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2010-060-02.nasl - Type : ACT_GATHER_INFO
2010-01-21	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-022.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1075.nasl - Type : ACT_GATHER_INFO
2009-12-08	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-323.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-6035.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_apache2-080925.nasl - Type : ACT_GATHER_INFO
2009-06-01	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-124.nasl - Type : ACT_GATHER_INFO
2009-05-28	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1075.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-731-1.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-195.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2009-03-13	Name : The remote openSUSE host is missing a security update. File : suse_apache2-6054.nasl - Type : ACT_GATHER_INFO
2008-11-16	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-5767.nasl - Type : ACT_GATHER_INFO
2008-11-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0967.nasl - Type : ACT_GATHER_INFO
2008-11-05	Name : The remote openSUSE host is missing a security update. File : suse_apache2-5628.nasl - Type : ACT_GATHER_INFO
2008-11-05	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-5629.nasl - Type : ACT_GATHER_INFO
2008-11-05	Name : The remote openSUSE host is missing a security update. File : suse_apache2-5648.nasl - Type : ACT_GATHER_INFO
2008-10-10	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2008-007.nasl - Type : ACT_GATHER_INFO
2008-08-08	Name : The remote Fedora host is missing a security update. File : fedora_2008-6393.nasl - Type : ACT_GATHER_INFO
2008-08-08	Name : The remote Fedora host is missing a security update. File : fedora_2008-6314.nasl - Type : ACT_GATHER_INFO
2008-07-11	Name : The remote web server may be affected by several issues. File : apache_2_2_9.nasl - Type : ACT_GATHER_INFO
2008-07-10	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200807-06.nasl - Type : ACT_GATHER_INFO
2008-06-24	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_c84dc9ad41f711dda4f900163e000016.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:35:57	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	3
Oval ID(s)	5
CPE ID(s)	193
osvdb(s)	3
Openvas Exploit(s)	33
Nessus® Exploit(s)	30

	Related
5	CVE-2008-2364
5	CVE-2008-1678
4.3	CVE-2007-6420
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 3 more Alert(s)