mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.

The remote NewStart CGSL host, running version MAIN 4.05, has httpd packages installed that are affected by multiple vulnerabilities:

  - Off-by-one error in the mod_ssl Certificate Revocation     List (CRL) verification callback in Apache, when     configured to use a CRL, allows remote attackers to     cause a denial of service (child process crash) via a     CRL that causes a buffer overflow of one null byte.
    (CVE-2005-1268)

  - The Apache HTTP server before 1.3.34, and 2.0.x before     2.0.55, when acting as an HTTP proxy, allows remote     attackers to poison the web cache, bypass web     application firewall protection, and conduct XSS attacks     via an HTTP request with both a Transfer-Encoding:
    chunked header and a Content-Length header, which     causes Apache to incorrectly handle and forward the body     of the request in a way that causes the receiving server     to process it as a separate HTTP request, aka HTTP     Request Smuggling. (CVE-2005-2088)

  - ssl_engine_kernel.c in mod_ssl before 2.8.24, when using     SSLVerifyClient optional in the global virtual host     configuration, does not properly enforce     SSLVerifyClient require in a per-location context,     which allows remote attackers to bypass intended access     restrictions. (CVE-2005-2700)

  - The byte-range filter in Apache 2.0 before 2.0.54 allows     remote attackers to cause a denial of service (memory     consumption) via an HTTP header with a large Range     field. (CVE-2005-2728)

  - Cross-site scripting (XSS) vulnerability in the mod_imap     module of Apache httpd before 1.3.35-dev and Apache     httpd 2.0.x before 2.0.56-dev allows remote attackers to     inject arbitrary web script or HTML via the Referer when     using image maps. (CVE-2005-3352)

  - mod_ssl in Apache 2.0 up to 2.0.55, when configured with     an SSL vhost with access control and a custom error 400     error page, allows remote attackers to cause a denial of     service (application crash) via a non-SSL request to an     SSL port, which triggers a NULL pointer dereference.
    (CVE-2005-3357)

  - The TLS protocol, and the SSL protocol 3.0 and possibly     earlier, as used in Microsoft Internet Information     Services (IIS) 7.0, mod_ssl in the Apache HTTP Server     2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5     and earlier, Mozilla Network Security Services (NSS)     3.12.4 and earlier, multiple Cisco products, and other     products, does not properly associate renegotiation     handshakes with an existing connection, which allows     man-in-the-middle attackers to insert data into HTTPS     sessions, and possibly other types of sessions protected     by TLS or SSL, by sending an unauthenticated request     that is processed retroactively by a server in a post-     renegotiation context, related to a plaintext     injection attack, aka the Project Mogul issue.
    (CVE-2009-3555)

  - The (1) mod_cache and (2) mod_dav modules in the Apache     HTTP Server 2.2.x before 2.2.16 allow remote attackers     to cause a denial of service (process crash) via a     request that lacks a path. (CVE-2010-1452)

  - fs/ext4/extents.c in the Linux kernel before 3.0 does     not mark a modified extent as dirty in certain cases of     extent splitting, which allows local users to cause a     denial of service (system crash) via vectors involving     ext4 umount and mount operations. (CVE-2011-3638)

  - It was discovered that the HTTP parser in httpd     incorrectly allowed certain characters not permitted by     the HTTP protocol specification to appear unencoded in     HTTP request headers. If httpd was used in conjunction     with a proxy or backend server that interpreted those     characters differently, a remote attacker could possibly     use this flaw to inject data into HTTP responses,     resulting in proxy cache poisoning. (CVE-2016-8743)

  - It was discovered that the use of httpd's     ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication     bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used     incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

  - A NULL pointer dereference flaw was found in the httpd's     mod_ssl module. A remote attacker could use this flaw to     cause an httpd child process to crash if another module     used by httpd called a certain API function during the     processing of an HTTPS request. (CVE-2017-3169)

  - A buffer over-read flaw was found in the httpd's     ap_find_token() function. A remote attacker could use     this flaw to cause httpd child process to crash via a     specially crafted HTTP request. (CVE-2017-7668)

  - A buffer over-read flaw was found in the httpd's     mod_mime module. A user permitted to modify httpd's MIME     configuration could use this flaw to cause httpd child     process to crash. (CVE-2017-7679)

  - It was discovered that the httpd's mod_auth_digest     module did not properly initialize memory before using     it when processing certain headers related to digest     authentication. A remote attacker could possibly use     this flaw to disclose potentially sensitive information     or cause httpd child process to crash by sending     specially crafted requests to a server. (CVE-2017-9788)

  - A use-after-free flaw was found in the way httpd handled     invalid and previously unregistered HTTP methods     specified in the Limit directive used in an .htaccess     file. A remote attacker could possibly use this flaw to     disclose portions of the server memory, or cause httpd     child process to crash. (CVE-2017-9798)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

s700_800 11.X OV NNM6.4x/ET2.0x Intermediate Patch 17 : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Potential vulnerabilities have been identified with HP     OpenView Network Node Manager (OV NNM) running Apache.
    These vulnerabilities could be exploited remotely     resulting in cross site scripting (XSS), Denial of     Service (DoS), or execution of arbitrary code.
    (HPSBMA02328 SSRT071293)

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM). This     vulnerability could be exploited remotely by an     unauthorized user to execute arbitrary code with the     permissions of the NNM server. (HPSBMA02281 SSRT061261)

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM) running Shared     Trace Service. The vulnerability could be remotely     exploited to execute arbitrary code. (HPSBMA02242     SSRT061260)

  - A potential security vulnerability has been identified     with HP OpenView Network Node Manager (OV NNM). The     vulnerability could be exploited remotely to create a     Denial of Service (DoS). (HPSBMA02307 SSRT071420)

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM). This     vulnerability could by exploited remotely to allow cross     site scripting (XSS). (HPSBMA02283 SSRT071319)

s700_800 11.X OV NNM7.01 Intermediate Patch 11 : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM). This     vulnerability could by exploited remotely to allow cross     site scripting (XSS). (HPSBMA02283 SSRT071319)

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM). This     vulnerability could be exploited remotely by an     unauthorized user to execute arbitrary code with the     permissions of the NNM server. (HPSBMA02281 SSRT061261)

  - Potential vulnerabilities have been identified with HP     OpenView Network Node Manager (OV NNM). The     vulnerabilities could be exploited remotely to create a     Denial of Service (DoS) or to execute arbitrary code.
    References: CVE-2008-3536, CVE-2008-3537, CVE-2008-3544     (Bugtraq ID 28668). (HPSBMA02362 SSRT080044, SSRT080045,     SSRT080042)

  - Potential vulnerabilities have been identified with HP     OpenView Network Node Manager (OV NNM) running Apache.
    These vulnerabilities could be exploited remotely     resulting in cross site scripting (XSS), Denial of     Service (DoS), or execution of arbitrary code.
    (HPSBMA02328 SSRT071293)

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM) running Shared     Trace Service. The vulnerability could be remotely     exploited to execute arbitrary code. (HPSBMA02242     SSRT061260)

  - A potential vulnerability has been identified with HP     OpenView Network Node Manager (OV NNM). The     vulnerability could be exploited remotely to execute     arbitrary code or to create a Denial of Service (DoS).
    (HPSBMA02348 SSRT080033)

s700_800 11.X IA-64 OV NNM7.51 Intermediate Patch 16 : 

Potential vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM) running Apache. These vulnerabilities could be exploited remotely resulting in cross site scripting (XSS), Denial of Service (DoS), or execution of arbitrary code.

s700_800 11.X PA-RISC OV NNM7.51 Intermediate Patch 16 : 

Potential vulnerabilities have been identified with HP OpenView Network Node Manager (OV NNM) running Apache. These vulnerabilities could be exploited remotely resulting in cross site scripting (XSS), Denial of Service (DoS), or execution of arbitrary code.

s700_800 11.04 Webproxy server 2.1 (Apache 2.x) update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A security vulnerability has been identified in OpenSSL     used in HP VirtualVault 4.7, 4.6, 4.5 and HP WebProxy     that may allow remote unauthorized access. (HPSBUX02165     SSRT061266)

  - Potential security vulnerabilities have been identified     with Apache running on HP-UX VirtualVault. These     vulnerabilities could be exploited remotely to allow     execution of arbitrary code, Denial of Service (DoS), or     unauthorized access. (HPSBUX02172 SSRT061269)

s700_800 11.04 Virtualvault 4.7 OWS (Apache 2.x) update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Potential security vulnerabilities have been identified     with Apache running on HP-UX VirtualVault. These     vulnerabilities could be exploited remotely to allow     execution of arbitrary code, Denial of Service (DoS), or     unauthorized access. (HPSBUX02172 SSRT061269)

  - A security vulnerability has been identified in OpenSSL     used in HP VirtualVault 4.7, 4.6, 4.5 and HP WebProxy     that may allow remote unauthorized access. (HPSBUX02165     SSRT061266)

Updated Apache httpd packages that correct three security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular and freely-available Web server.

A memory leak in the worker MPM could allow remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2970 to this issue. This vulnerability only affects users who are using the non-default worker MPM.

A flaw in mod_imap when using the Referer directive with image maps was discovered. With certain site configurations, a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers. (CVE-2005-3352)

A NULL pointer dereference flaw in mod_ssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This crash would only be a denial of service if using the non-default worker MPM. (CVE-2005-3357)

Users of httpd should update to these erratum packages which contain backported patches to correct these issues along with some additional bugs.

The remote host is affected by the vulnerability described in GLSA-200602-03 (Apache: Multiple vulnerabilities)

    Apache's mod_imap fails to properly sanitize the 'Referer' directive of     imagemaps in some cases, leaving the HTTP Referer header unescaped. A     flaw in mod_ssl can lead to a NULL pointer dereference if the site uses     a custom 'Error 400' document. These vulnerabilities were reported by     Marc Cox and Hartmut Keil, respectively.
  Impact :

    A remote attacker could exploit mod_imap to inject arbitrary HTML or     JavaScript into a user's browser to gather sensitive information.
    Attackers could also cause a Denial of Service on hosts using the SSL     module (Apache 2.0.x only).
  Workaround :

    There is no known workaround at this time.

The 'mod_imap' module (which provides support for image maps) did not properly escape the 'referer' URL which rendered it vulnerable against a cross-site scripting attack. A malicious web page (or HTML email) could trick a user into visiting a site running the vulnerable mod_imap, and employ cross-site-scripting techniques to gather sensitive user information from that site. (CVE-2005-3352)

Hartmut Keil discovered a Denial of Service vulnerability in the SSL module ('mod_ssl') that affects SSL-enabled virtual hosts with a customized error page for error 400. By sending a specially crafted request to the server, a remote attacker could crash the server. This only affects Apache 2, and only if the 'worker' implementation (apache2-mpm-worker) is used. (CVE-2005-3357).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes fixes for three security issues in the Apache HTTP Server.

A memory leak in the worker MPM could allow remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2970 to this issue. This vulnerability only affects users who are using the non-default worker MPM.

A flaw in mod_imap when using the Referer directive with image maps was discovered. With certain site configurations, a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers. (CVE-2005-3352)

A NULL pointer dereference flaw in mod_ssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This crash would only be a denial of service if using the non-default worker MPM. (CVE-2005-3357)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was discovered in mod_imap when using the Referer directive with image maps that could be used by a remote attacker to perform a cross- site scripting attack, in certain site configurations, if a victim could be forced to visit a malicious URL using certain web browsers (CVE-2005-3352).

Also, a NULL pointer dereference flaw was found in mod_ssl that affects server configurations where an SSL virtual host was configured with access controls and a custom 400 error document. This could allow a remote attacker to send a carefully crafted request to trigger the issue and cause a crash, but only with the non-default worker MPM (CVE-2005-3357).

The provided packages have been patched to prevent these problems.

The version of Apache running on the remote host is affected by a denial of service vulnerability due to a flaw in mod_ssl that occurs when it is configured with an SSL vhost with access control and a custom 400 error page. A remote attacker can exploit this, via a non-SSL request to an SSL port, to cause a NULL pointer to be dereferenced, resulting in crashing individual child processes or even the entire server.

ID	Name	Product	Family	Severity
127360	NewStart CGSL MAIN 4.05 : httpd Multiple Vulnerabilities (NS-SA-2019-0118)	Nessus	NewStart CGSL Local Security Checks	critical
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
29200	HP-UX PHSS_37141 : s700_800 11.X OV NNM6.4x/ET2.0x Intermediate Patch 17	Nessus	HP-UX Local Security Checks	critical
26896	HP-UX PHSS_36773 : s700_800 11.X OV NNM7.01 Intermediate Patch 11	Nessus	HP-UX Local Security Checks	critical
26155	HP-UX PHSS_36386 : HP OpenView Network Node Manager (OV NNM) Running Apache, Remote Cross Site Scripting (XSS), Denial of Service (DoS), Execute Arbitrary Code (HPSBMA02328 SSRT071293 rev.2)	Nessus	HP-UX Local Security Checks	high
26154	HP-UX PHSS_36385 : HP OpenView Network Node Manager (OV NNM) Running Apache, Remote Cross Site Scripting (XSS), Denial of Service (DoS), Execute Arbitrary Code (HPSBMA02328 SSRT071293 rev.2)	Nessus	HP-UX Local Security Checks	high
23715	HP-UX PHSS_35437 : s700_800 11.04 Webproxy server 2.1 (Apache 2.x) update	Nessus	HP-UX Local Security Checks	high
23714	HP-UX PHSS_35436 : s700_800 11.04 Virtualvault 4.7 OWS (Apache 2.x) update	Nessus	HP-UX Local Security Checks	high
21884	CentOS 3 / 4 : httpd (CESA-2006:0159)	Nessus	CentOS Local Security Checks	medium
20874	GLSA-200602-03 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
20788	Ubuntu 4.10 / 5.04 / 5.10 : apache2, apache vulnerabilities (USN-241-1)	Nessus	Ubuntu Local Security Checks	medium
20757	Fedora Core 4 : httpd-2.0.54-10.3 (2006-052)	Nessus	Fedora Local Security Checks	medium
20473	Mandrake Linux Security Advisory : apache2 (MDKSA-2006:007)	Nessus	Mandriva Local Security Checks	medium
20398	RHEL 3 / 4 : httpd (RHSA-2006:0159)	Nessus	Red Hat Local Security Checks	medium
20386	Apache mod_ssl ssl_hook_Access Error Handling DoS	Nessus	Web Servers	medium

Detections

Analytics

CVE-2005-3357

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high

medium

medium

medium

medium

medium

medium

medium