Vulnerabilities > CVE-2002-0843

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.

Nessus

  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2002-068.NASL
    descriptionA number of vulnerabilities were discovered in Apache versions prior to 1.3.27. The first is regarding the use of shared memory (SHM) in Apache. An attacker that is able to execute code as the UID of the webserver (typically
    last seen2020-06-01
    modified2020-06-02
    plugin id13968
    published2004-07-31
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13968
    titleMandrake Linux Security Advisory : apache (MDKSA-2002:068)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandrake Linux Security Advisory MDKSA-2002:068. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(13968);
      script_version ("1.22");
      script_cvs_date("Date: 2019/08/02 13:32:46");
    
      script_cve_id("CVE-2002-0839", "CVE-2002-0840", "CVE-2002-0843");
      script_xref(name:"MDKSA", value:"2002:068");
    
      script_name(english:"Mandrake Linux Security Advisory : apache (MDKSA-2002:068)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandrake Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A number of vulnerabilities were discovered in Apache versions prior
    to 1.3.27. The first is regarding the use of shared memory (SHM) in
    Apache. An attacker that is able to execute code as the UID of the
    webserver (typically 'apache') is able to send arbitrary processes a
    USR1 signal as root. Using this vulnerability, the attacker can also
    cause the Apache process to continously span more children processes,
    thus causing a local DoS. Another vulnerability was discovered by
    Matthew Murphy regarding a cross site scripting vulnerability in the
    standard 404 error page. Finally, some buffer overflows were found in
    the 'ab' benchmark program that is included with Apache.
    
    All of these vulnerabilities were fixed in Apache 1.3.27; the packages
    provided have these fixes applied."
      );
      # http://marc.theaimsgroup.com/?l=apache-httpd-users&m=103367270822891&w=2
      script_set_attribute(
        attribute:"see_also",
        value:"https://marc.info/?l=apache-httpd-users&m=103367270822891&w=2"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:apache");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:apache-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:apache-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:apache-manual");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:apache-modules");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:apache-source");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:7.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:8.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:8.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:8.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:9.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2002/10/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"apache-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"apache-common-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"apache-devel-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"apache-manual-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"apache-modules-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK7.2", cpu:"i386", reference:"apache-source-1.3.22-10.2mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"apache-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"apache-common-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"apache-devel-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"apache-manual-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"apache-modules-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.0", cpu:"i386", reference:"apache-source-1.3.22-10.2mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK8.1", cpu:"i386", reference:"apache-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.1", cpu:"i386", reference:"apache-common-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.1", cpu:"i386", reference:"apache-devel-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.1", cpu:"i386", reference:"apache-manual-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.1", cpu:"i386", reference:"apache-modules-1.3.22-10.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.1", cpu:"i386", reference:"apache-source-1.3.22-10.2mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK8.2", cpu:"i386", reference:"apache-1.3.23-4.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.2", cpu:"i386", reference:"apache-common-1.3.23-4.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.2", cpu:"i386", reference:"apache-devel-1.3.23-4.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.2", cpu:"i386", reference:"apache-manual-1.3.23-4.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.2", cpu:"i386", reference:"apache-modules-1.3.23-4.2mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK8.2", cpu:"i386", reference:"apache-source-1.3.23-4.2mdk", yank:"mdk")) flag++;
    
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"apache-1.3.26-6.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"apache-common-1.3.26-6.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"apache-devel-1.3.26-6.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"apache-manual-1.3.26-6.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"apache-modules-1.3.26-6.1mdk", yank:"mdk")) flag++;
    if (rpm_check(release:"MDK9.0", cpu:"i386", reference:"apache-source-1.3.26-6.1mdk", yank:"mdk")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2002-251.NASL
    descriptionUpdated apache and httpd packages are available which fix a number of security issues for Red Hat Linux Advanced Server 2.1. [Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1 The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Buffer overflows in the ApacheBench support program (ab.c) in Apache versions prior to 1.3.27 allow a malicious Web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project has assigned the name CVE-2002-0843 to this issue. Two cross-site scripting vulnerabilities are present in the error pages for the default
    last seen2020-06-01
    modified2020-06-02
    plugin id12332
    published2004-07-06
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/12332
    titleRHEL 2.1 : apache (RHSA-2002:251)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2002:251. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(12332);
      script_version ("1.21");
      script_cvs_date("Date: 2019/10/25 13:36:10");
    
      script_cve_id("CVE-2002-0839", "CVE-2002-0840", "CVE-2002-0843", "CVE-2002-1157");
      script_xref(name:"RHSA", value:"2002:251");
    
      script_name(english:"RHEL 2.1 : apache (RHSA-2002:251)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated apache and httpd packages are available which fix a number of
    security issues for Red Hat Linux Advanced Server 2.1.
    
    [Updated 06 Feb 2003] Added fixed packages for Advanced Workstation
    2.1
    
    The Apache HTTP server is a powerful, full-featured, efficient, and
    freely-available Web server.
    
    Buffer overflows in the ApacheBench support program (ab.c) in Apache
    versions prior to 1.3.27 allow a malicious Web server to cause a
    denial of service and possibly execute arbitrary code via a long
    response. The Common Vulnerabilities and Exposures project has
    assigned the name CVE-2002-0843 to this issue.
    
    Two cross-site scripting vulnerabilities are present in the error
    pages for the default '404 Not Found' error, and for the error
    response when a plain HTTP request is received on an SSL port. Both of
    these issues are only exploitable if the 'UseCanonicalName' setting
    has been changed to 'Off', and wildcard DNS is in use. These issues
    would allow remote attackers to execute scripts as other Web page
    visitors, for instance, to steal cookies. These issues affect versions
    of Apache 1.3 before 1.3.26, and versions of mod_ssl before 2.8.12.
    The Common Vulnerabilities and Exposures project has assigned the
    names CVE-2002-0840 and CVE-2002-1157 to these issues.
    
    The shared memory scoreboard in the HTTP daemon for Apache 1.3, prior
    to version 1.3.27, allowed a user running as the 'apache' UID to send
    a SIGUSR1 signal to any process as root, resulting in a denial of
    service (process kill) or other such behavior that would not normally
    be allowed. The Common Vulnerabilities and Exposures project has
    assigned the name CVE-2002-0839 to this issue.
    
    All users of the Apache HTTP server are advised to upgrade to the
    applicable errata packages. For Red Hat Linux Advanced Server 2.1
    these packages include Apache version 1.3.27 which is not vulnerable
    to these issues.
    
    Note that the instructions in the 'Solution' section of this errata
    contain additional steps required to complete the upgrade process."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2002-0839"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2002-0840"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2002-0843"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2002-1157"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.apacheweek.com/issues/02-10-04"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2002:251"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:apache");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:apache-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:apache-manual");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mod_ssl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2002/10/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2003/02/05");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/06");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^2\.1([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    if (cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i386", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2002:251";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"apache-1.3.27-2")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"apache-devel-1.3.27-2")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"apache-manual-1.3.27-2")) flag++;
      if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"mod_ssl-2.8.12-2")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "apache / apache-devel / apache-manual / mod_ssl");
      }
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-187.NASL
    descriptionAccording to David Wagner, iDEFENSE and the Apache HTTP Server Project, several remotely exploitable vulnerabilities have been found in the Apache package, a commonly used webserver. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross scripting attack. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities : - CAN-2002-0839: A vulnerability exists on platforms using System V shared memory based scoreboards. This vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial of service attack. - CAN-2002-0840: Apache is susceptible to a cross site scripting vulnerability in the default 404 page of any web server hosted on a domain that allows wildcard DNS lookups. - CAN-2002-0843: There were some possible overflows in the utility ApacheBench (ab) which could be exploited by a malicious server. - CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program. - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. This is the same vulnerability as CAN-2002-1233, which was fixed in potato already but got lost later and was never applied upstream. - NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings. These problems have been fixed in version 1.3.26-0woody3 for the current stable distribution (woody) and in 1.3.9-14.3 for the old stable distribution (potato). Corrected packages for the unstable distribution (sid) are expected soon.
    last seen2020-06-01
    modified2020-06-02
    plugin id15024
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15024
    titleDebian DSA-187-1 : apache - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-187. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(15024);
      script_version("1.21");
      script_cvs_date("Date: 2019/08/02 13:32:17");
    
      script_cve_id("CVE-2001-0131", "CVE-2002-0839", "CVE-2002-0840", "CVE-2002-0843", "CVE-2002-1233");
      script_bugtraq_id(2182, 5847, 5884, 5887, 5995);
      script_xref(name:"DSA", value:"187");
    
      script_name(english:"Debian DSA-187-1 : apache - several vulnerabilities");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "According to David Wagner, iDEFENSE and the Apache HTTP Server
    Project, several remotely exploitable vulnerabilities have been found
    in the Apache package, a commonly used webserver. These
    vulnerabilities could allow an attacker to enact a denial of service
    against a server or execute a cross scripting attack. The Common
    Vulnerabilities and Exposures (CVE) project identified the following
    vulnerabilities :
    
      - CAN-2002-0839: A vulnerability exists on platforms using
        System V shared memory based scoreboards. This
        vulnerability allows an attacker to execute code under
        the Apache UID to exploit the Apache shared memory
        scoreboard format and send a signal to any process as
        root or cause a local denial of service attack.
      - CAN-2002-0840: Apache is susceptible to a cross site
        scripting vulnerability in the default 404 page of any
        web server hosted on a domain that allows wildcard DNS
        lookups.
    
      - CAN-2002-0843: There were some possible overflows in the
        utility ApacheBench (ab) which could be exploited by a
        malicious server.
    
      - CAN-2002-1233: A race condition in the htpasswd and
        htdigest program enables a malicious local user to read
        or even modify the contents of a password file or easily
        create and overwrite files as the user running the
        htpasswd (or htdigest respectively) program.
    
      - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9,
        1.3.14, and others allows local users to overwrite
        arbitrary files via a symlink attack.
    
        This is the same vulnerability as CAN-2002-1233, which
        was fixed in potato already but got lost later and was
        never applied upstream.
    
      - NO-CAN: Several buffer overflows have been found in the
        ApacheBench (ab) utility that could be exploited by a
        remote server returning very long strings.
    These problems have been fixed in version 1.3.26-0woody3 for the
    current stable distribution (woody) and in 1.3.9-14.3 for the old
    stable distribution (potato). Corrected packages for the unstable
    distribution (sid) are expected soon."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.debian.org/security/2002/dsa-187"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade the Apache package immediately."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:apache");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:2.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2002/11/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
      script_set_attribute(attribute:"vuln_publication_date", value:"2002/10/02");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"2.2", prefix:"apache", reference:"1.3.9-14.3")) flag++;
    if (deb_check(release:"2.2", prefix:"apache-common", reference:"1.3.9-14.3")) flag++;
    if (deb_check(release:"2.2", prefix:"apache-dev", reference:"1.3.9-14.3")) flag++;
    if (deb_check(release:"2.2", prefix:"apache-doc", reference:"1.3.9-14.3")) flag++;
    if (deb_check(release:"3.0", prefix:"apache", reference:"1.3.26-0woody3")) flag++;
    if (deb_check(release:"3.0", prefix:"apache-common", reference:"1.3.26-0woody3")) flag++;
    if (deb_check(release:"3.0", prefix:"apache-dev", reference:"1.3.26-0woody3")) flag++;
    if (deb_check(release:"3.0", prefix:"apache-doc", reference:"1.3.26-0woody3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_28098.NASL
    descriptions700_800 11.04 Virtualvault 4.5 OWS update : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen2020-06-01
    modified2020-06-02
    plugin id17490
    published2005-03-18
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17490
    titleHP-UX PHSS_28098 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and patch checks in this plugin were 
    # extracted from HP patch PHSS_28098. The text itself is
    # copyright (C) Hewlett-Packard Development Company, L.P.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(17490);
      script_version("1.16");
      script_cvs_date("Date: 2019/07/10 16:04:13");
    
      script_cve_id("CVE-2002-0839", "CVE-2002-0840", "CVE-2002-0843", "CVE-2002-1156");
      script_xref(name:"CERT", value:"240329");
      script_xref(name:"CERT", value:"825353");
      script_xref(name:"CERT", value:"858881");
      script_xref(name:"CERT", value:"91071");
      script_xref(name:"HP", value:"emr_na-c00944288");
      script_xref(name:"HP", value:"HPSBUX00224");
      script_xref(name:"HP", value:"SSRT2393");
    
      script_name(english:"HP-UX PHSS_28098 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)");
      script_summary(english:"Checks for the patch in the swlist output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote HP-UX host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "s700_800 11.04 Virtualvault 4.5 OWS update : 
    
    Potential vulnerability regarding ownership permissions of System V
    shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839)
    Potential cross-site scripting vulnerability in the default error page
    when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential
    overflows in ab.c which could be exploited by a malicious server.
    (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST
    request is sent to a location where both DAV and CGI are enabled.
    (CERT VU#91071, CVE CAN-2002-1156)."
      );
      # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00944288
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4d769217"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install patch PHSS_28098 or subsequent."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2002/10/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2003/02/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/03/18");
      script_set_attribute(attribute:"patch_modification_date", value:"2007/04/05");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"HP-UX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("hpux.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
    if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    if (!hpux_check_ctx(ctx:"11.04"))
    {
      exit(0, "The host is not affected since PHSS_28098 applies to a different OS release.");
    }
    
    patches = make_list("PHSS_28098", "PHSS_28685", "PHSS_29545", "PHSS_29690", "PHSS_30160", "PHSS_30648", "PHSS_31828", "PHSS_32184", "PHSS_33396", "PHSS_34119", "PHSS_35107", "PHSS_35461", "PHSS_35556");
    foreach patch (patches)
    {
      if (hpux_installed(app:patch))
      {
        exit(0, "The host is not affected because patch "+patch+" is installed.");
      }
    }
    
    
    flag = 0;
    if (hpux_check_patch(app:"VaultTS.VV-CORE-CMN", version:"A.04.50")) flag++;
    if (hpux_check_patch(app:"VaultTS.VV-IWS-GUI", version:"A.04.50")) flag++;
    if (hpux_check_patch(app:"VaultTS.VV-IWS-JAVA", version:"A.04.50")) flag++;
    if (hpux_check_patch(app:"VaultTS.VV-IWS-JK", version:"A.04.50")) flag++;
    if (hpux_check_patch(app:"VaultWS.WS-CORE", version:"A.04.50")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_28090.NASL
    descriptions700_800 11.04 Virtualvault 4.6 IWS update. : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen2020-06-01
    modified2020-06-02
    plugin id17118
    published2005-02-16
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17118
    titleHP-UX PHSS_28090 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and patch checks in this plugin were 
    # extracted from HP patch PHSS_28090. The text itself is
    # copyright (C) Hewlett-Packard Development Company, L.P.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(17118);
      script_version("1.17");
      script_cvs_date("Date: 2019/07/10 16:04:13");
    
      script_cve_id("CVE-2002-0839", "CVE-2002-0840", "CVE-2002-0843", "CVE-2002-1156");
      script_xref(name:"CERT", value:"240329");
      script_xref(name:"CERT", value:"825353");
      script_xref(name:"CERT", value:"858881");
      script_xref(name:"CERT", value:"91071");
      script_xref(name:"HP", value:"emr_na-c00944288");
      script_xref(name:"HP", value:"HPSBUX00224");
      script_xref(name:"HP", value:"SSRT2393");
    
      script_name(english:"HP-UX PHSS_28090 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)");
      script_summary(english:"Checks for the patch in the swlist output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote HP-UX host is missing a security-related patch."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "s700_800 11.04 Virtualvault 4.6 IWS update. : 
    
    Potential vulnerability regarding ownership permissions of System V
    shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839)
    Potential cross-site scripting vulnerability in the default error page
    when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential
    overflows in ab.c which could be exploited by a malicious server.
    (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST
    request is sent to a location where both DAV and CGI are enabled.
    (CERT VU#91071, CVE CAN-2002-1156)."
      );
      # http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00944288
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4d769217"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Install patch PHSS_28090 or subsequent."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:hp:hp-ux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2002/10/11");
      script_set_attribute(attribute:"patch_publication_date", value:"2003/02/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2005/02/16");
      script_set_attribute(attribute:"patch_modification_date", value:"2007/04/05");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"HP-UX Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/HP-UX/version", "Host/HP-UX/swlist");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("hpux.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/HP-UX/version")) audit(AUDIT_OS_NOT, "HP-UX");
    if (!get_kb_item("Host/HP-UX/swlist")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    if (!hpux_check_ctx(ctx:"11.04"))
    {
      exit(0, "The host is not affected since PHSS_28090 applies to a different OS release.");
    }
    
    patches = make_list("PHSS_28090", "PHSS_28684", "PHSS_29542", "PHSS_29893", "PHSS_30153", "PHSS_30643", "PHSS_30946", "PHSS_31825", "PHSS_32139", "PHSS_32206", "PHSS_34170", "PHSS_35105", "PHSS_35307", "PHSS_35459", "PHSS_35554");
    foreach patch (patches)
    {
      if (hpux_installed(app:patch))
      {
        exit(0, "The host is not affected because patch "+patch+" is installed.");
      }
    }
    
    
    flag = 0;
    if (hpux_check_patch(app:"VaultTS.VV-IWS", version:"A.04.60")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:hpux_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWeb Servers
    NASL idORACLE_APPLICATION_SERVER_PCI.NASL
    descriptionThe remote host is running Oracle Application Server. It was not possible to determine its version, so the version of Oracle Application Server installed on the remote host could potentially be affected by multiple vulnerabilities : - CVE-2000-0169: Remote command execution in the web listener component. - CVE-2000-1235: Information disclosure in the port listener component and modplsql. - CVE-2000-1236: SQL injection in mod_sql. - CVE-2001-0326: Information disclosure in the Java Virtual Machine. - CVE-2001-0419: Buffer overflow in ndwfn4.so. - CVE-2001-0591: Directory traversal. - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module. - CVE-2001-1217: Directory traversal vulnerability in the PL/SQL Apache module. - CVE-2001-1371: Improper access control in the SOAP service. - CVE-2001-1372: Information disclosure. - CVE-2002-0386: Denial of service through the administration module for Oracle Web Cache. - CVE-2002-0559: Buffer overflows in the PL/SQL module. - CVE-2002-0560: Information disclosure in the PL/SQL module. - CVE-2002-0561: Authentication bypass in the PL/SQL Gateway web administration interface. - CVE-2002-0562: Information disclosure through globals.jsa. - CVE-2002-0563: Improper access control on several services. - CVE-2002-0564: Authentication bypass in the PL/SQL module. - CVE-2002-0565: Information disclosure through JSP files in the _pages directory. - CVE-2002-0566: Denial of service in the PL/SQL module. - CVE-2002-0568: Improper access control on XSQLConfig.xml and soapConfig.xml. - CVE-2002-0569: Authentication bypass through XSQLServlet. - CVE-2002-0655: Denial of service in OpenSSL. - CVE-2002-0656: Buffer overflows in OpenSSL. - CVE-2002-0659: Denial of service in OpenSSL. - CVE-2002-0840: Cross-site scripting in the default error page of Apache. - CVE-2002-0842: Format string vulnerability in mod_dav. - CVE-2002-0843: Buffer overflows in ApacheBench. - CVE-2002-0947: Buffer overflow in rwcgi60. - CVE-2002-1089: Information disclosure in rwcgi60. - CVE-2002-1630: Improper access control on sendmail.jsp. - CVE-2002-1631: SQL injection in query.xsql. - CVE-2002-1632: Information disclosure through several JSP pages. - CVE-2002-1635: Information disclosure in Apache. - CVE-2002-1636: Cross-site scripting in the htp PL/SQL package. - CVE-2002-1637: Default credentials in multiple components. - CVE-2002-1858: Information disclosure through the WEB-INF directory. - CVE-2002-2153: Format string vulnerability in the administrative pages of the PL/SQL module. - CVE-2002-2345: Credential leakage in the web cache administrator interface. - CVE-2002-2347: Cross-site scripting in several JSP pages. - CVE-2004-1362: Authentication bypass in the PL/SQL module. - CVE-2004-1363: Buffer overflow in extproc. - CVE-2004-1364: Directory traversal in extproc. - CVE-2004-1365: Command execution in extproc. - CVE-2004-1366: Improper access control on emoms.properties. - CVE-2004-1367: Credential leakage in Database Server. - CVE-2004-1368: Arbitrary file execution in ISQL*Plus. - CVE-2004-1369: Denial of service in TNS Listener. - CVE-2004-1370: Multiple SQL injection vulnerabilities in PL/SQL. - CVE-2004-1371: Stack-based buffer overflow. - CVE-2004-1707: Privilege escalation in dbsnmp and nmo. - CVE-2004-1774: Buffer overflow in the MD2 package. - CVE-2004-1877: Phishing vulnerability in Single Sign-On component. - CVE-2004-2134: Weak cryptography for passwords in the toplink mapping workBench. - CVE-2004-2244: Denial of service in the XML parser. - CVE-2005-1383: Authentication bypass in HTTP Server. - CVE-2005-1495: Detection bypass. - CVE-2005-1496: Privilege escalation in the DBMS_Scheduler. - CVE-2005-2093: Web cache poisoning. - CVE-2005-3204: Cross-site scripting. - CVE-2005-3445: Multiple unspecified vulnerabilities in HTTP Server. - CVE-2005-3446: Unspecified vulnerability in Internet Directory. - CVE-2005-3447: Unspecified vulnerability in Single Sign-On. - CVE-2005-3448: Unspecified vulnerability in the OC4J module. - CVE-2005-3449: Multiple unspecified vulnerabilities in multiple components. - CVE-2005-3450: Unspecified vulnerability in HTTP Server. - CVE-2005-3451: Unspecified vulnerability in SQL*ReportWriter. - CVE-2005-3452: Unspecified vulnerability in Web Cache. - CVE-2005-3453: Multiple unspecified vulnerabilities in Web Cache. - CVE-2006-0273: Unspecified vulnerability in the Portal component. - CVE-2006-0274: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2006-0275: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2006-0282: Unspecified vulnerability. - CVE-2006-0283: Unspecified vulnerability. - CVE-2006-0284: Multiple unspecified vulnerabilities. - CVE-2006-0285: Unspecified vulnerability in the Java Net component. - CVE-2006-0286: Unspecified vulnerability in HTTP Server. - CVE-2006-0287: Unspecified vulnerability in HTTP Server. - CVE-2006-0288: Multiple unspecified vulnerabilities in the Oracle Reports Developer component. - CVE-2006-0289: Multiple unspecified vulnerabilities. - CVE-2006-0290: Unspecified vulnerability in the Oracle Workflow Cartridge component. - CVE-2006-0291: Multiple unspecified vulnerabilities in the Oracle Workflow Cartridge component. - CVE-2006-0435: Unspecified vulnerability in Oracle PL/SQL. - CVE-2006-0552: Unspecified vulnerability in the Net Listener component. - CVE-2006-0586: Multiple SQL injection vulnerabilities. - CVE-2006-1884: Unspecified vulnerability in the Oracle Thesaurus Management System component. - CVE-2006-3706: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3707: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3708: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3709: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3710: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3711: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3712: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3713: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-3714: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5353: Unspecified vulnerability in HTTP Server. - CVE-2006-5354: Unspecified vulnerability in HTTP Server. - CVE-2006-5355: Unspecified vulnerability in Single Sign-On. - CVE-2006-5356: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5357: Unspecified vulnerability in HTTP Server. - CVE-2006-5358: Unspecified vulnerability in the Oracle Forms component. - CVE-2006-5359: Multiple unspecified vulnerabilities in Oracle Reports Developer component. - CVE-2006-5360: Unspecified vulnerability in Oracle Forms component. - CVE-2006-5361: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5362: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5363: Unspecified vulnerability in Single Sign-On. - CVE-2006-5364: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2006-5365: Unspecified vulnerability in Oracle Forms. - CVE-2006-5366: Multiple unspecified vulnerabilities. - CVE-2007-0222: Directory traversal vulnerability in EmChartBean. - CVE-2007-0275: Cross-site scripting vulnerability in Oracle Reports Web Cartridge (RWCGI60). - CVE-2007-0280: Buffer overflow in Oracle Notification Service. - CVE-2007-0281: Multiple unspecified vulnerabilities in HTTP Server. - CVE-2007-0282: Unspecified vulnerability in OPMN02. - CVE-2007-0283: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0284: Multiple unspecified vulnerabilities in Oracle Containers for J2EE. - CVE-2007-0285: Unspecified vulnerability in Oracle Reports Developer. - CVE-2007-0286: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0287: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-0288: Unspecified vulnerability in Oracle Internet Directory. - CVE-2007-0289: Multiple unspecified vulnerabilities in Oracle Containers for J2EE. - CVE-2007-1359: Improper access control in mod_security. - CVE-2007-1609: Cross-site scripting vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS). - CVE-2007-2119: Cross-site scripting vulnerability in the Administration Front End for Oracle Enterprise (Ultra) Search. - CVE-2007-2120: Denial of service in the Oracle Discoverer servlet. - CVE-2007-2121: Unspecified vulnerability in the COREid Access component. - CVE-2007-2122: Unspecified vulnerability in the Wireless component. - CVE-2007-2123: Unspecified vulnerability in the Portal component. - CVE-2007-2124: Unspecified vulnerability in the Portal component. - CVE-2007-2130: Unspecified vulnerability in Workflow Cartridge. - CVE-2007-3553: Cross-site scripting vulnerability in Rapid Install Web Server. - CVE-2007-3854: Multiple unspecified vulnerabilities in the Advanced Queuing component and the Spatial component. - CVE-2007-3859: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-3861: Unspecified vulnerability in Oracle Jdeveloper. - CVE-2007-3862: Unspecified vulnerability in Single Sign-On. - CVE-2007-3863: Unspecified vulnerability in Oracle JDeveloper. - CVE-2007-5516: Unspecified vulnerability in the Oracle Process Mgmt & Notification component. - CVE-2007-5517: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5518: Unspecified vulnerability in HTTP Server. - CVE-2007-5519: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5520: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-5521: Unspecified vulnerability in Oracle Containers for J2EE. - CVE-2007-5522: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5523: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2007-5524: Unspecified vulnerability in Single Sign-On. - CVE-2007-5525: Unspecified vulnerability in Single Sign-On. - CVE-2007-5526: Unspecified vulnerability in the Oracle Portal component. - CVE-2007-5531: Unspecified vulnerability in Oracle Help for Web. - CVE-2008-0340: Multiple unspecified vulnerabilities in the Advanced Queuing component and Spatial component. - CVE-2008-0343: Unspecified vulnerability in the Oracle Spatial component. - CVE-2008-0344: Unspecified vulnerability in the Oracle Spatial component. - CVE-2008-0345: Unspecified vulnerability in the Core RDBMS component. - CVE-2008-0346: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2008-0347: Unspecified vulnerability in the Oracle Ultra Search component. - CVE-2008-0348: Multiple unspecified vulnerabilities in the PeopleTools component. - CVE-2008-0349: Unspecified vulnerability in the PeopleTools component. - CVE-2008-1812: Unspecified vulnerability in the Oracle Enterprise Manager component. - CVE-2008-1814: Unspecified vulnerability in the Oracle Secure Enterprise Search or Ultrasearch component. - CVE-2008-1823: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2008-1824: Unspecified vulnerability in the Oracle Dynamic Monitoring Service component. - CVE-2008-1825: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2583: Unspecified vulnerability in the sample Discussion Forum Portlet for the Oracle Portal component. - CVE-2008-2588: Unspecified vulnerability in the Oracle JDeveloper component. - CVE-2008-2589: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2593: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2594: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2595: Unspecified vulnerability in the Oracle Internet Directory component. - CVE-2008-2609: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-2612: Unspecified vulnerability in the Hyperion BI Plus component. - CVE-2008-2614: Unspecified vulnerability in HTTP Server. - CVE-2008-2619: Unspecified vulnerability in the Oracle Reports Developer component. - CVE-2008-2623: Unspecified vulnerability in the Oracle JDeveloper component. - CVE-2008-3975: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-3977: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-3986: Unspecified vulnerability in the Oracle Discoverer Administrator component. - CVE-2008-3987: Unspecified vulnerability in the Oracle Discoverer Desktop component. - CVE-2008-4014: Unspecified vulnerability in the Oracle BPEL Process Manager component. - CVE-2008-4017: Unspecified vulnerability in the OC4J component. - CVE-2008-5438: Unspecified vulnerability in the Oracle Portal component. - CVE-2008-7233: Unspecified vulnerability in the Oracle Jinitiator component. - CVE-2009-0217: Signature spoofing vulnerability in multiple components. - CVE-2009-0989: Unspecified vulnerability in the BI Publisher component. - CVE-2009-0990: Unspecified vulnerability in the BI Publisher component. - CVE-2009-0994: Unspecified vulnerability in the BI Publisher component. - CVE-2009-1008: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1009: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1010: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1011: Unspecified vulnerability in the Outside In Technology component. - CVE-2009-1017: Unspecified vulnerability in the BI Publisher component. - CVE-2009-1976: Unspecified vulnerability in HTTP Server. - CVE-2009-1990: Unspecified vulnerability in the Business Intelligence Enterprise Edition component. - CVE-2009-1999: Unspecified vulnerability in the Business Intelligence Enterprise Edition component. - CVE-2009-3407: Unspecified vulnerability in the Portal component. - CVE-2009-3412: Unspecified vulnerability in the Unzip component. - CVE-2010-0066: Unspecified vulnerability in the Access Manager Identity Server component. - CVE-2010-0067: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2010-0070: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2011-0789: Unspecified vulnerability in HTTP Server. - CVE-2011-0795: Unspecified vulnerability in Single Sign-On. - CVE-2011-0884: Unspecified vulnerability in the Oracle BPEL Process Manager component. - CVE-2011-2237: Unspecified vulnerability in the Oracle Web Services Manager component. - CVE-2011-2314: Unspecified vulnerability in the Oracle Containers for J2EE component. - CVE-2011-3523: Unspecified vulnerability in the Oracle Web Services Manager component.
    last seen2020-06-01
    modified2020-06-02
    plugin id57619
    published2012-01-24
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/57619
    titleOracle Application Server Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(57619);
      script_version("1.23");
      script_cvs_date("Date: 2019/04/05 15:04:42");
    
      script_cve_id(
        "CVE-2000-0169",
        "CVE-2000-1235",
        "CVE-2000-1236",
        "CVE-2001-0326",
        "CVE-2001-0419",
        "CVE-2001-0591",
        "CVE-2001-1216",
        "CVE-2001-1217",
        "CVE-2001-1371",
        "CVE-2001-1372",
        "CVE-2002-0386",
        "CVE-2002-0559",
        "CVE-2002-0560",
        "CVE-2002-0561",
        "CVE-2002-0562",
        "CVE-2002-0563",
        "CVE-2002-0564",
        "CVE-2002-0565",
        "CVE-2002-0566",
        "CVE-2002-0568",
        "CVE-2002-0569",
        "CVE-2002-0655",
        "CVE-2002-0656",
        "CVE-2002-0659",
        "CVE-2002-0840",
        "CVE-2002-0842",
        "CVE-2002-0843",
        "CVE-2002-0947",
        "CVE-2002-1089",
        "CVE-2002-1630",
        "CVE-2002-1631",
        "CVE-2002-1632",
        "CVE-2002-1635",
        "CVE-2002-1636",
        "CVE-2002-1637",
        "CVE-2002-1858",
        "CVE-2002-2153",
        "CVE-2002-2345",
        "CVE-2002-2347",
        "CVE-2004-1362",
        "CVE-2004-1363",
        "CVE-2004-1364",
        "CVE-2004-1365",
        "CVE-2004-1366",
        "CVE-2004-1367",
        "CVE-2004-1368",
        "CVE-2004-1369",
        "CVE-2004-1370",
        "CVE-2004-1371",
        "CVE-2004-1707",
        "CVE-2004-1774",
        "CVE-2004-1877",
        "CVE-2004-2134",
        "CVE-2004-2244",
        "CVE-2005-1383",
        "CVE-2005-1495",
        "CVE-2005-1496",
        "CVE-2005-2093",
        "CVE-2005-3204",
        "CVE-2005-3445",
        "CVE-2005-3446",
        "CVE-2005-3447",
        "CVE-2005-3448",
        "CVE-2005-3449",
        "CVE-2005-3450",
        "CVE-2005-3451",
        "CVE-2005-3452",
        "CVE-2005-3453",
        "CVE-2006-0273",
        "CVE-2006-0274",
        "CVE-2006-0275",
        "CVE-2006-0282",
        "CVE-2006-0283",
        "CVE-2006-0284",
        "CVE-2006-0285",
        "CVE-2006-0286",
        "CVE-2006-0287",
        "CVE-2006-0288",
        "CVE-2006-0289",
        "CVE-2006-0290",
        "CVE-2006-0291",
        "CVE-2006-0435",
        "CVE-2006-0552",
        "CVE-2006-0586",
        "CVE-2006-1884",
        "CVE-2006-3706",
        "CVE-2006-3707",
        "CVE-2006-3708",
        "CVE-2006-3709",
        "CVE-2006-3710",
        "CVE-2006-3711",
        "CVE-2006-3712",
        "CVE-2006-3713",
        "CVE-2006-3714",
        "CVE-2006-5353",
        "CVE-2006-5354",
        "CVE-2006-5355",
        "CVE-2006-5356",
        "CVE-2006-5357",
        "CVE-2006-5358",
        "CVE-2006-5359",
        "CVE-2006-5360",
        "CVE-2006-5361",
        "CVE-2006-5362",
        "CVE-2006-5363",
        "CVE-2006-5364",
        "CVE-2006-5365",
        "CVE-2006-5366",
        "CVE-2007-0222",
        "CVE-2007-0275",
        "CVE-2007-0280",
        "CVE-2007-0281",
        "CVE-2007-0282",
        "CVE-2007-0283",
        "CVE-2007-0284",
        "CVE-2007-0285",
        "CVE-2007-0286",
        "CVE-2007-0287",
        "CVE-2007-0288",
        "CVE-2007-0289",
        "CVE-2007-1359",
        "CVE-2007-1609",
        "CVE-2007-2119",
        "CVE-2007-2120",
        "CVE-2007-2121",
        "CVE-2007-2122",
        "CVE-2007-2123",
        "CVE-2007-2124",
        "CVE-2007-2130",
        "CVE-2007-3553",
        "CVE-2007-3854",
        "CVE-2007-3859",
        "CVE-2007-3861",
        "CVE-2007-3862",
        "CVE-2007-3863",
        "CVE-2007-5516",
        "CVE-2007-5517",
        "CVE-2007-5518",
        "CVE-2007-5519",
        "CVE-2007-5520",
        "CVE-2007-5521",
        "CVE-2007-5522",
        "CVE-2007-5523",
        "CVE-2007-5524",
        "CVE-2007-5525",
        "CVE-2007-5526",
        "CVE-2007-5531",
        "CVE-2008-0340",
        "CVE-2008-0343",
        "CVE-2008-0344",
        "CVE-2008-0345",
        "CVE-2008-0346",
        "CVE-2008-0347",
        "CVE-2008-0348",
        "CVE-2008-0349",
        "CVE-2008-1812",
        "CVE-2008-1814",
        "CVE-2008-1823",
        "CVE-2008-1824",
        "CVE-2008-1825",
        "CVE-2008-2583",
        "CVE-2008-2588",
        "CVE-2008-2589",
        "CVE-2008-2593",
        "CVE-2008-2594",
        "CVE-2008-2595",
        "CVE-2008-2609",
        "CVE-2008-2612",
        "CVE-2008-2614",
        "CVE-2008-2619",
        "CVE-2008-2623",
        "CVE-2008-3975",
        "CVE-2008-3977",
        "CVE-2008-3986",
        "CVE-2008-3987",
        "CVE-2008-4014",
        "CVE-2008-4017",
        "CVE-2008-5438",
        "CVE-2008-7233",
        "CVE-2009-0217",
        "CVE-2009-0989",
        "CVE-2009-0990",
        "CVE-2009-0994",
        "CVE-2009-1008",
        "CVE-2009-1009",
        "CVE-2009-1010",
        "CVE-2009-1011",
        "CVE-2009-1017",
        "CVE-2009-1976",
        "CVE-2009-1990",
        "CVE-2009-1999",
        "CVE-2009-3407",
        "CVE-2009-3412",
        "CVE-2010-0066",
        "CVE-2010-0067",
        "CVE-2010-0070",
        "CVE-2011-0789",
        "CVE-2011-0795",
        "CVE-2011-0884",
        "CVE-2011-2237",
        "CVE-2011-2314",
        "CVE-2011-3523"
      );
    
      script_bugtraq_id(
        1053,
        2150,
        2286,
        2569,
        3341,
        3726,
        3727,
        4032,
        4034,
        4037,
        4289,
        4290,
        4292,
        4293,
        4294,
        4298,
        4844,
        4848,
        5119,
        5262,
        5362,
        5363,
        5364,
        5366,
        5452,
        5847,
        5887,
        5902,
        5995,
        5996,
        6556,
        6846,
        7395,
        9515,
        9703,
        10009,
        10829,
        10871,
        13145,
        13418,
        13509,
        15034,
        15134,
        16287,
        16294,
        16384,
        17590,
        19054,
        20588,
        22027,
        22083,
        22831,
        23102,
        23532,
        24697,
        27229,
        33177,
        34461,
        35671,
        35688,
        36746,
        36749,
        36753,
        50202,
        50209
      );
    
      script_name(english:"Oracle Application Server Multiple Vulnerabilities");
      script_summary(english:"Checks version in Server response header.");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote web server may be affected by multiple vulnerabilities.");
     script_set_attribute(attribute:"description", value:
    "The remote host is running Oracle Application Server. It was not possible
    to determine its version, so the version of Oracle Application Server
    installed on the remote host could potentially be affected by multiple
    vulnerabilities :
    
      - CVE-2000-0169: Remote command execution in the web
        listener component.
    
      - CVE-2000-1235: Information disclosure in the port
        listener component and modplsql.
    
      - CVE-2000-1236: SQL injection in mod_sql.
    
      - CVE-2001-0326: Information disclosure in the Java
        Virtual Machine.
    
      - CVE-2001-0419: Buffer overflow in ndwfn4.so.
    
      - CVE-2001-0591: Directory traversal.
    
      - CVE-2001-1216: Buffer overflow in the PL/SQL Apache module.
    
      - CVE-2001-1217: Directory traversal vulnerability in the
        PL/SQL Apache module.
    
      - CVE-2001-1371: Improper access control in the SOAP
        service.
    
      - CVE-2001-1372: Information disclosure.
    
      - CVE-2002-0386: Denial of service through the
        administration module for Oracle Web Cache.
    
      - CVE-2002-0559: Buffer overflows in the PL/SQL module.
    
      - CVE-2002-0560: Information disclosure in the PL/SQL
        module.
    
      - CVE-2002-0561: Authentication bypass in the PL/SQL
        Gateway web administration interface.
    
      - CVE-2002-0562: Information disclosure through
        globals.jsa.
    
      - CVE-2002-0563: Improper access control on several
        services.
    
      - CVE-2002-0564: Authentication bypass in the PL/SQL
        module.
    
      - CVE-2002-0565: Information disclosure through JSP files
        in the _pages directory.
    
      - CVE-2002-0566: Denial of service in the PL/SQL module.
    
      - CVE-2002-0568: Improper access control on XSQLConfig.xml
        and soapConfig.xml.
    
      - CVE-2002-0569: Authentication bypass through
        XSQLServlet.
    
      - CVE-2002-0655: Denial of service in OpenSSL.
    
      - CVE-2002-0656: Buffer overflows in OpenSSL.
    
      - CVE-2002-0659: Denial of service in OpenSSL.
    
      - CVE-2002-0840: Cross-site scripting in the default error
        page of Apache.
    
      - CVE-2002-0842: Format string vulnerability in mod_dav.
    
      - CVE-2002-0843: Buffer overflows in ApacheBench.
    
      - CVE-2002-0947: Buffer overflow in rwcgi60.
    
      - CVE-2002-1089: Information disclosure in rwcgi60.
    
      - CVE-2002-1630: Improper access control on sendmail.jsp.
    
      - CVE-2002-1631: SQL injection in query.xsql.
    
      - CVE-2002-1632: Information disclosure through several
        JSP pages.
    
      - CVE-2002-1635: Information disclosure in Apache.
    
      - CVE-2002-1636: Cross-site scripting in the htp PL/SQL
        package.
    
      - CVE-2002-1637: Default credentials in multiple
        components.
    
      - CVE-2002-1858: Information disclosure through the
        WEB-INF directory.
    
      - CVE-2002-2153: Format string vulnerability in the
        administrative pages of the PL/SQL module.
    
      - CVE-2002-2345: Credential leakage in the web cache
        administrator interface.
    
      - CVE-2002-2347: Cross-site scripting in several JSP
        pages.
    
      - CVE-2004-1362: Authentication bypass in the PL/SQL
        module.
    
      - CVE-2004-1363: Buffer overflow in extproc.
    
      - CVE-2004-1364: Directory traversal in extproc.
    
      - CVE-2004-1365: Command execution in extproc.
    
      - CVE-2004-1366: Improper access control on
        emoms.properties.
    
      - CVE-2004-1367: Credential leakage in Database Server.
    
      - CVE-2004-1368: Arbitrary file execution in ISQL*Plus.
    
      - CVE-2004-1369: Denial of service in TNS Listener.
    
      - CVE-2004-1370: Multiple SQL injection vulnerabilities in
        PL/SQL.
    
      - CVE-2004-1371: Stack-based buffer overflow.
    
      - CVE-2004-1707: Privilege escalation in dbsnmp and nmo.
    
      - CVE-2004-1774: Buffer overflow in the MD2 package.
    
      - CVE-2004-1877: Phishing vulnerability in Single Sign-On
        component.
    
      - CVE-2004-2134: Weak cryptography for passwords in the
        toplink mapping workBench.
    
      - CVE-2004-2244: Denial of service in the XML parser.
    
      - CVE-2005-1383: Authentication bypass in HTTP Server.
    
      - CVE-2005-1495: Detection bypass.
    
      - CVE-2005-1496: Privilege escalation in the
        DBMS_Scheduler.
    
      - CVE-2005-2093: Web cache poisoning.
    
      - CVE-2005-3204: Cross-site scripting.
    
      - CVE-2005-3445: Multiple unspecified vulnerabilities in
        HTTP Server.
    
      - CVE-2005-3446: Unspecified vulnerability in Internet
        Directory.
    
      - CVE-2005-3447: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2005-3448: Unspecified vulnerability in the OC4J
        module.
    
      - CVE-2005-3449: Multiple unspecified vulnerabilities in
        multiple components.
    
      - CVE-2005-3450: Unspecified vulnerability in HTTP Server.
    
      - CVE-2005-3451: Unspecified vulnerability in
        SQL*ReportWriter.
    
      - CVE-2005-3452: Unspecified vulnerability in Web Cache.
    
      - CVE-2005-3453: Multiple unspecified vulnerabilities in
        Web Cache.
    
      - CVE-2006-0273: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2006-0274: Unspecified vulnerability in the Oracle
        Reports Developer component.
    
      - CVE-2006-0275: Unspecified vulnerability in the Oracle
        Reports Developer component.
    
      - CVE-2006-0282: Unspecified vulnerability.
    
      - CVE-2006-0283: Unspecified vulnerability.
    
      - CVE-2006-0284: Multiple unspecified vulnerabilities.
    
      - CVE-2006-0285: Unspecified vulnerability in the Java Net
        component.
    
      - CVE-2006-0286: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-0287: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-0288: Multiple unspecified vulnerabilities in
        the Oracle Reports Developer component.
    
      - CVE-2006-0289: Multiple unspecified vulnerabilities.
    
      - CVE-2006-0290: Unspecified vulnerability in the Oracle
        Workflow Cartridge component.
    
      - CVE-2006-0291: Multiple unspecified vulnerabilities in
        the Oracle Workflow Cartridge component.
    
      - CVE-2006-0435: Unspecified vulnerability in Oracle
        PL/SQL.
    
      - CVE-2006-0552: Unspecified vulnerability in the Net
        Listener component.
    
      - CVE-2006-0586: Multiple SQL injection vulnerabilities.
    
      - CVE-2006-1884: Unspecified vulnerability in the Oracle
        Thesaurus Management System component.
    
      - CVE-2006-3706: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3707: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3708: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3709: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3710: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3711: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3712: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3713: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-3714: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5353: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-5354: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-5355: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2006-5356: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5357: Unspecified vulnerability in HTTP Server.
    
      - CVE-2006-5358: Unspecified vulnerability in the Oracle
        Forms component.
    
      - CVE-2006-5359: Multiple unspecified vulnerabilities in
        Oracle Reports Developer component.
    
      - CVE-2006-5360: Unspecified vulnerability in Oracle Forms
        component.
    
      - CVE-2006-5361: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5362: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5363: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2006-5364: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2006-5365: Unspecified vulnerability in Oracle
        Forms.
    
      - CVE-2006-5366: Multiple unspecified vulnerabilities.
    
      - CVE-2007-0222: Directory traversal vulnerability in
        EmChartBean.
    
      - CVE-2007-0275: Cross-site scripting vulnerability in
        Oracle Reports Web Cartridge (RWCGI60).
    
      - CVE-2007-0280: Buffer overflow in Oracle Notification
        Service.
    
      - CVE-2007-0281: Multiple unspecified vulnerabilities in
        HTTP Server.
    
      - CVE-2007-0282: Unspecified vulnerability in OPMN02.
    
      - CVE-2007-0283: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-0284: Multiple unspecified vulnerabilities in
        Oracle Containers for J2EE.
    
      - CVE-2007-0285: Unspecified vulnerability in Oracle
        Reports Developer.
    
      - CVE-2007-0286: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-0287: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-0288: Unspecified vulnerability in Oracle
        Internet Directory.
    
      - CVE-2007-0289: Multiple unspecified vulnerabilities in
        Oracle Containers for J2EE.
    
      - CVE-2007-1359: Improper access control in mod_security.
    
      - CVE-2007-1609: Cross-site scripting vulnerability in
        servlet/Spy in Dynamic Monitoring Services (DMS).
    
      - CVE-2007-2119: Cross-site scripting vulnerability in the
        Administration Front End for Oracle Enterprise (Ultra)
        Search.
    
      - CVE-2007-2120: Denial of service in the Oracle
        Discoverer servlet.
    
      - CVE-2007-2121: Unspecified vulnerability in the COREid
        Access component.
    
      - CVE-2007-2122: Unspecified vulnerability in the Wireless
        component.
    
      - CVE-2007-2123: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2007-2124: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2007-2130: Unspecified vulnerability in Workflow
        Cartridge.
    
      - CVE-2007-3553: Cross-site scripting vulnerability in
        Rapid Install Web Server.
    
      - CVE-2007-3854: Multiple unspecified vulnerabilities in
        the Advanced Queuing component and the Spatial
        component.
    
      - CVE-2007-3859: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2007-3861: Unspecified vulnerability in Oracle
        Jdeveloper.
    
      - CVE-2007-3862: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2007-3863: Unspecified vulnerability in Oracle
        JDeveloper.
    
      - CVE-2007-5516: Unspecified vulnerability in the Oracle
        Process Mgmt & Notification component.
    
      - CVE-2007-5517: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5518: Unspecified vulnerability in HTTP Server.
    
      - CVE-2007-5519: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5520: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2007-5521: Unspecified vulnerability in Oracle
        Containers for J2EE.
    
      - CVE-2007-5522: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5523: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2007-5524: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2007-5525: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2007-5526: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2007-5531: Unspecified vulnerability in Oracle Help
        for Web.
    
      - CVE-2008-0340: Multiple unspecified vulnerabilities in
        the Advanced Queuing component and Spatial component.
    
      - CVE-2008-0343: Unspecified vulnerability in the Oracle
        Spatial component.
    
      - CVE-2008-0344: Unspecified vulnerability in the Oracle
        Spatial component.
    
      - CVE-2008-0345: Unspecified vulnerability in the Core
        RDBMS component.
    
      - CVE-2008-0346: Unspecified vulnerability in the Oracle
        Jinitiator component.
    
      - CVE-2008-0347: Unspecified vulnerability in the Oracle
        Ultra Search component.
    
      - CVE-2008-0348: Multiple unspecified vulnerabilities in
        the PeopleTools component.
    
      - CVE-2008-0349: Unspecified vulnerability in the
        PeopleTools component.
    
      - CVE-2008-1812: Unspecified vulnerability in the Oracle
        Enterprise Manager component.
    
      - CVE-2008-1814: Unspecified vulnerability in the Oracle
        Secure Enterprise Search or Ultrasearch component.
    
      - CVE-2008-1823: Unspecified vulnerability in the Oracle
        Jinitiator component.
    
      - CVE-2008-1824: Unspecified vulnerability in the Oracle
        Dynamic Monitoring Service component.
    
      - CVE-2008-1825: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2583: Unspecified vulnerability in the sample
        Discussion Forum Portlet for the Oracle Portal
        component.
    
      - CVE-2008-2588: Unspecified vulnerability in the Oracle
        JDeveloper component.
    
      - CVE-2008-2589: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2593: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2594: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2595: Unspecified vulnerability in the Oracle
        Internet Directory component.
    
      - CVE-2008-2609: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-2612: Unspecified vulnerability in the Hyperion
        BI Plus component.
    
      - CVE-2008-2614: Unspecified vulnerability in HTTP Server.
    
      - CVE-2008-2619: Unspecified vulnerability in the Oracle
        Reports Developer component.
    
      - CVE-2008-2623: Unspecified vulnerability in the Oracle
        JDeveloper component.
    
      - CVE-2008-3975: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-3977: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-3986: Unspecified vulnerability in the Oracle
        Discoverer Administrator component.
    
      - CVE-2008-3987: Unspecified vulnerability in the Oracle
        Discoverer Desktop component.
    
      - CVE-2008-4014: Unspecified vulnerability in the Oracle
        BPEL Process Manager component.
    
      - CVE-2008-4017: Unspecified vulnerability in the OC4J
        component.
    
      - CVE-2008-5438: Unspecified vulnerability in the Oracle
        Portal component.
    
      - CVE-2008-7233: Unspecified vulnerability in the Oracle
        Jinitiator component.
    
      - CVE-2009-0217: Signature spoofing vulnerability in
        multiple components.
    
      - CVE-2009-0989: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-0990: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-0994: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-1008: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1009: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1010: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1011: Unspecified vulnerability in the Outside
        In Technology component.
    
      - CVE-2009-1017: Unspecified vulnerability in the BI
        Publisher component.
    
      - CVE-2009-1976: Unspecified vulnerability in HTTP Server.
    
      - CVE-2009-1990: Unspecified vulnerability in the Business
        Intelligence Enterprise Edition component.
    
      - CVE-2009-1999: Unspecified vulnerability in the Business
        Intelligence Enterprise Edition component.
    
      - CVE-2009-3407: Unspecified vulnerability in the Portal
        component.
    
      - CVE-2009-3412: Unspecified vulnerability in the Unzip
        component.
    
      - CVE-2010-0066: Unspecified vulnerability in the Access
        Manager Identity Server component.
    
      - CVE-2010-0067: Unspecified vulnerability in the Oracle
        Containers for J2EE component.
    
      - CVE-2010-0070: Unspecified vulnerability in the Oracle
        Containers for J2EE component.
    
      - CVE-2011-0789: Unspecified vulnerability in HTTP Server.
    
      - CVE-2011-0795: Unspecified vulnerability in Single
        Sign-On.
    
      - CVE-2011-0884: Unspecified vulnerability in the Oracle
        BPEL Process Manager component.
    
      - CVE-2011-2237: Unspecified vulnerability in the Oracle
        Web Services Manager component.
    
      - CVE-2011-2314: Unspecified vulnerability in the Oracle
        Containers for J2EE component.
    
      - CVE-2011-3523: Unspecified vulnerability in the Oracle
        Web Services Manager component.");
      script_set_attribute(attribute:"solution", value:
    "Verify that the version of Oracle Application Server installed is not
    affected by the listed vulnerabilities and/or filter incoming traffic to this port");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"manual");
      script_set_attribute(attribute:"cvss_score_rationale", value:"remote code execution");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploithub_sku", value:"EH-11-053");
      script_set_attribute(attribute:"exploit_framework_exploithub", value:"true");
      script_set_attribute(attribute:"d2_elliot_name", value:"Oracle Secure Backup 10.2.0.2 RCE (Windows)");
      script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
      script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
      script_set_attribute(attribute:"canvas_package", value:'CANVAS');
      script_cwe_id(22, 79, 119, 200, 255, 264, 287);
      script_set_attribute(attribute:"vuln_publication_date", value:"2000/03/14");
      script_set_attribute(attribute:"patch_publication_date", value:"2011/10/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/01/24");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:application_server");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Web Servers");
    
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("find_service2.nasl");
      script_require_keys("Settings/PCI_DSS", "Settings/ParanoidReport");
      script_require_ports("Services/oracle_application_server");
    
      exit(0);
    }
    
    include("global_settings.inc");
    include("http.inc");
    include("misc_func.inc");
    
    # Only PCI considers this an issue.
    if (!get_kb_item("Settings/PCI_DSS")) exit(0, "PCI-DSS compliance checking is not enabled.");
    
    # Make sure this is Oracle.
    port = get_kb_item_or_exit("Services/oracle_application_server");
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    # We're flagging every installation of Oracle Application Server, with
    # every vulnerability it has ever had.
    security_hole(port);
    
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_28099.NASL
    descriptions700_800 11.04 Virtualvault 4.6 OWS update : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen2020-06-01
    modified2020-06-02
    plugin id17491
    published2005-03-18
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17491
    titleHP-UX PHSS_28099 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_28111.NASL
    descriptions700_800 11.04 Virtualvault 4.5 IWS Update : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen2020-06-01
    modified2020-06-02
    plugin id17492
    published2005-03-18
    reporterThis script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/17492
    titleHP-UX PHSS_28111 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-195.NASL
    descriptionAccording to David Wagner, iDEFENSE and the Apache HTTP Server Project, several vulnerabilities have been found in the Apache server package, a commonly used webserver. Most of the code is shared between the Apache and Apache-Perl packages, so vulnerabilities are shared as well. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross site scripting attack, or steal cookies from other website users. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities : - CAN-2002-0839: A vulnerability exists on platforms using System V shared memory based scoreboards. This vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial of service attack. - CAN-2002-0840: Apache is susceptible to a cross site scripting vulnerability in the default 404 page of any web server hosted on a domain that allows wildcard DNS lookups. - CAN-2002-0843: There were some possible overflows in the utility ApacheBench (ab) which could be exploited by a malicious server. No such binary programs are distributed by the Apache-Perl package, though. - CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program. No such binary programs are distributed by the Apache-Perl package, though. - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. No such binary programs are distributed by the Apache-Perl package, though. - NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings. No such binary programs are distributed by the Apache-Perl package, though. These problems have been fixed in version 1.3.26-1-1.26-0woody2 for the current stable distribution (woody), in 1.3.9-14.1-1.21.20000309-1.1 for the old stable distribution (potato) and in version 1.3.26-1.1-1.27-3-1 for the unstable distribution (sid).
    last seen2020-06-01
    modified2020-06-02
    plugin id15032
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15032
    titleDebian DSA-195-1 : apache-perl - several vulnerabilities
  • NASL familyHP-UX Local Security Checks
    NASL idHPUX_PHSS_28705.NASL
    descriptions700_800 11.X OV NNM6.2 Intermediate Patch, Feb 2003 : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen2020-06-01
    modified2020-06-02
    plugin id16993
    published2005-02-16
    reporterThis script is Copyright (C) 2005-2013 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/16993
    titleHP-UX PHSS_28705 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-188.NASL
    descriptionAccording to David Wagner, iDEFENSE and the Apache HTTP Server Project, several vulnerabilities have been found in the Apache package, a commonly used webserver. Most of the code is shared between the Apache and Apache-SSL packages, so vulnerabilities are shared as well. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross scripting attack, or steal cookies from other web site users. Vulnerabilities in the included legacy programs htdigest, htpasswd and ApacheBench can be exploited when called via CGI. Additionally the insecure temporary file creation in htdigest and htpasswd can also be exploited locally. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities : - CAN-2002-0839: A vulnerability exists on platforms using System V shared memory based scoreboards. This vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial of service attack. - CAN-2002-0840: Apache is susceptible to a cross site scripting vulnerability in the default 404 page of any web server hosted on a domain that allows wildcard DNS lookups. - CAN-2002-0843: There were some possible overflows in the utility ApacheBench (ab) which could be exploited by a malicious server. - CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program. (binaries not included in apache-ssl package though) - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. This is the same vulnerability as CAN-2002-1233, which was fixed in potato already but got lost later and was never applied upstream. (binaries not included in apache-ssl package though) - NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings. (binary not included in apache-ssl package though) These problems have been fixed in version 1.3.26.1+1.48-0woody3 for the current stable distribution (woody) and in 1.3.9.13-4.2 for the old stable distribution (potato). Corrected packages for the unstable distribution (sid) are expected soon.
    last seen2020-06-01
    modified2020-06-02
    plugin id15025
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15025
    titleDebian DSA-188-1 : apache-ssl - several vulnerabilities
  • NASL familyWeb Servers
    NASL idAPACHE_1_3_27.NASL
    descriptionThe remote host is running a version of Apache web server prior to 1.3.27. It is, therefore, affected by multiple vulnerabilities : - There is a cross-site scripting vulnerability caused by a failure to filter HTTP/1.1
    last seen2020-06-01
    modified2020-06-02
    plugin id11137
    published2002-10-04
    reporterThis script is Copyright (C) 2002-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/11137
    titleApache < 1.3.27 Multiple Vulnerabilities (DoS, XSS)

Statements

contributorMark J Cox
lastmodified2008-07-02
organizationApache
statementFixed in Apache HTTP Server 1.3.27: http://httpd.apache.org/security/vulnerabilities_13.html

References