Vulnerabilities > CVE-2011-1498 - Information Exposure vulnerability in Apache Httpclient 4.0/4.0.1/4.1

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2011-7747.
#

include("compat.inc");

if (description)
{
  script_id(55147);
  script_version("1.11");
  script_cvs_date("Date: 2019/08/02 13:32:35");

  script_cve_id("CVE-2011-1498");
  script_bugtraq_id(46974);
  script_xref(name:"FEDORA", value:"2011-7747");

  script_name(english:"Fedora 15 : httpcomponents-client-4.1.1-2.fc15 (2011-7747)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This updated fixes several bug. See
http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1
.x.txt for details

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  # http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?2b960bf2"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=709531"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?789070ba"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected httpcomponents-client package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:httpcomponents-client");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:15");

  script_set_attribute(attribute:"patch_publication_date", value:"2011/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2011/06/16");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^15([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 15.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC15", reference:"httpcomponents-client-4.1.1-2.fc15")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "httpcomponents-client");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(77533);
  script_version("1.5");
  script_cvs_date("Date: 2019/11/25");

  script_cve_id(
    "CVE-2011-1498",
    "CVE-2014-3102",
    "CVE-2014-4746",
    "CVE-2014-4760"
  );
  script_bugtraq_id(
    46974,
    69044,
    69045,
    69047
  );
  script_xref(name:"CERT", value:"153049");

  script_name(english:"IBM WebSphere Portal 8.x < 8.0.0.1 CF13 Multiple Vulnerabilities");
  script_summary(english:"Checks for installed patches.");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host has web portal software installed that is
affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of IBM WebSphere Portal on the remote host is affected by
multiple vulnerabilities :

  - An information disclosure vulnerability exists in the
    HttpClient component of the Apache HttpComponents
    library. An attacker can exploit this issue by
    sending a Proxy-Authorization header to retrieve a
    user's password. (CVE-2011-1498)

  - An unspecified cross-site scripting vulnerability
    exists due to improper validation of user input. An
    attacker can exploit this issue to execute code in
    the security context of a user's browser.
    (CVE-2014-3102)

  - An information disclosure vulnerability exists due to
    the returned error codes which an attacker can use to
    identify devices behind a firewall. (CVE-2014-4746)

  - An unspecified open redirect vulnerability exists that
    can allow an attacker to perform a phishing attack by
    enticing a user to click on a malicious URL.
    (CVE-2014-4760)");
  script_set_attribute(attribute:"see_also", value:"https://www-304.ibm.com/support/docview.wss?uid=swg21676776");
  # https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_fixes_available_for_vulnerability_in_apache_httpcomponents_httpclient_contained_in_ibm_websphere_portal_cve_2011_1498?lang=en_us
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4c0df724");
  script_set_attribute(attribute:"see_also", value:"https://www-304.ibm.com/support/docview.wss?uid=swg21680230");
  # https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_fixes_available_for_security_vulnerabilities_in_ibm_websphere_portal_multiple_cves1?lang=en_us
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ad660435");
  script_set_attribute(attribute:"solution", value:
"IBM has published a cumulative fix for WebSphere Portal 8.0.0.1
(CF13). Refer to IBM's advisory for more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-4760");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/07/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/09/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:websphere_portal");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("websphere_portal_installed.nbin");
  script_require_keys("installed_sw/IBM WebSphere Portal");

  exit(0);
}

include("websphere_portal_version.inc");

websphere_portal_check_version(
  ranges:make_list("8.0.0.0, 8.0.0.1"),
  fix:"CF13",
  severity:SECURITY_WARNING,
  xss:TRUE
);