cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0556 advisory.

    [2.2.3-7.el5.0.1]
     - Marks removal + index page cleanup

     [2.2.3-7.el5]
     - add security fixes for CVE-2007-1863, CVE-2007-3304,        and CVE-2006-5752 (#244665)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0534 :

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A bug was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

From Red Hat Security Advisory 2007:0533 :

Updated Apache httpd packages that correct two security issues and two bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A flaw was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

In addition, two bugs were fixed :

* when the ProxyErrorOverride directive was enabled, responses with 3xx status-codes would be overriden at the proxy. This has been changed so that only 4xx and 5xx responses are overriden.

* the 'ProxyTimeout' directive was not inherited across virtual host definitions.

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A flaw was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service (CVE-2007-3304). This issue is not exploitable on Scientific Linux 5 if using the default SELinux targeted policy.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Scientific Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A bug was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-003 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.3. 

Mac OS X 10.5.3 contains security fixes for a number of programs.

Several bugs were fixed in the Apache2 webserver :

These include the following security issues :

  - mod_status: Fix a possible XSS attack against a site     with a public server-status page and ExtendedStatus     enabled, for browsers which perform charset 'detection'.
    (CVE-2006-5752)

  - mod_cache: Prevent a segmentation fault if attributes     are listed in a Cache-Control header without any value.
    (CVE-2007-1863)

  - prefork, worker, event MPMs: Ensure that the parent     process cannot be forced to kill processes outside its     process group. (CVE-2007-3304)

  - mod_proxy: Prevent reading past the end of a buffer when     parsing date-related headers. PR 41144. (CVE-2007-3847)

  - mod_autoindex: Add in ContentType and Charset options to     IndexOptions directive. This allows the admin to     explicitly set the content-type and charset of the     generated page. (CVE-2007-4465)

and the following non-security issues :

  - get_module_list: replace loadmodule.conf atomically

  - Use File::Temp to create good tmpdir in logresolve.pl2     (httpd-2.x.x-logresolve.patchs)

Several bugs were fixed in the Apache2 webserver :

These include the following security issues :

  - CVE-2006-5752: mod_status: Fix a possible XSS attack     against a site with a public server-status page and     ExtendedStatus enabled, for browsers which perform     charset 'detection'.

  - CVE-2007-1863: mod_cache: Prevent a segmentation fault     if attributes are listed in a Cache-Control header     without any value.

  - CVE-2007-3304: prefork, worker, event MPMs: Ensure that     the parent process cannot be forced to kill processes     outside its process group.

  - CVE-2007-3847: mod_proxy: Prevent reading past the end     of a buffer when parsing date-related headers. PR 41144.

  - CVE-2007-4465: mod_autoindex: Add in ContentType and     Charset options to IndexOptions directive. This allows     the admin to explicitly set the content-type and charset     of the generated page.

and the following non-security issues :

  - get_module_list: replace loadmodule.conf atomically

  - Use File::Temp to create good tmpdir in logresolve.pl2     (httpd-2.x.x-logresolve.patchs)

Stefan Esser discovered that mod_status did not force a character set, which could result in browsers becoming vulnerable to XSS attacks when processing the output. If a user were tricked into viewing server status output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. By default, mod_status is disabled in Ubuntu. (CVE-2006-5752)

Niklas Edmundsson discovered that the mod_cache module could be made to crash using a specially crafted request. A remote user could use this to cause a denial of service if Apache was configured to use a threaded worker. By default, mod_cache is disabled in Ubuntu.
(CVE-2007-1863)

A flaw was discovered in the signal handling of Apache. A local attacker could trick Apache into sending SIGUSR1 to other processes.
The vulnerable code was only present in Ubuntu Feisty. (CVE-2007-3304).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-06 (Apache: Multiple vulnerabilities)

    Multiple cross-site scripting vulnerabilities have been discovered in     mod_status and mod_autoindex (CVE-2006-5752, CVE-2007-4465). An error     has been discovered in the recall_headers() function in mod_mem_cache     (CVE-2007-1862). The mod_cache module does not properly sanitize     requests before processing them (CVE-2007-1863). The Prefork module     does not properly check PID values before sending signals     (CVE-2007-3304). The mod_proxy module does not correctly check headers     before processing them (CVE-2007-3847).
  Impact :

    A remote attacker could exploit one of these vulnerabilities to inject     arbitrary script or HTML content, obtain sensitive information or cause     a Denial of Service.
  Workaround :

    There is no known workaround at this time.

This update includes the latest stable release of the Apache HTTP Server.

A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module.
(CVE-2007-3847)

A flaw was found in the mod_autoindex module. On sites where directory listings are used, and the AddDefaultCharset directive has been removed from the configuration, a cross-site-scripting attack may be possible against browsers which do not correctly derive the response character set following the rules in RFC 2616. (CVE-2007-4465)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service (CVE-2007-3304). This issue is not exploitable on Fedora if using the default SELinux targeted policy.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Fedora the server-status page is not enabled by default and it is best practice to not make this publicly available. (CVE-2006-5752)

A bug was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

A bug was found in the mod_mem_cache module. On sites where caching is enabled using this module, an information leak could occur which revealed portions of sensitive memory to remote users. (CVE-2007-1862)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apache HTTP server project reports :

The following potential security flaws are addressed :

- CVE-2007-3847: mod_proxy: Prevent reading past the end of a buffer when parsing date-related headers.

- CVE-2007-1863: mod_cache: Prevent a segmentation fault if attributes are listed in a Cache-Control header without any value.

- CVE-2007-3304: prefork, worker, event MPMs: Ensure that the parent process cannot be forced to kill processes outside its process group.

- CVE-2006-5752: mod_status: Fix a possible XSS attack against a site with a public server-status page and ExtendedStatus enabled, for browsers which perform charset 'detection'. Reported by Stefan Esser.

- CVE-2006-1862: mod_mem_cache: Copy headers into longer lived storage; header names and values could previously point to cleaned up storage.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.6. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability in mod_proxy. 
  - A cross-site scripting vulnerability in mod_status.
  - A local denial of service vulnerability associated with     the Prefork MPM module.
  - An information leak in mod_cache.
  - A denial of service vulnerability in mod_cache.

In addition, it offers a workaround for a cross-site scripting issue in mod_autoindex. 

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether any of the affected modules are in use on the remote server or to check for the issues themselves.

A vulnerability was discovered in the the Apache mod_status module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled (CVE-2006-5752).

A vulnerability was found in the Apache mod_cache module that could cause the httpd server child process to crash if it was sent a carefully crafted request. This could lead to a denial of service if using a threaded MPM (CVE-2007-1863).

The Apache server also did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the server could manipulate the scoreboard and cause arbitrary processes to be terminated (CVE-2007-3304).

Updated packages have been patched to prevent the above issues.

Updated Apache httpd packages that correct two security issues and two bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A flaw was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

In addition, two bugs were fixed :

* when the ProxyErrorOverride directive was enabled, responses with 3xx status-codes would be overriden at the proxy. This has been changed so that only 4xx and 5xx responses are overriden.

* the 'ProxyTimeout' directive was not inherited across virtual host definitions.

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

Updated Apache httpd packages that correct three security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service (CVE-2007-3304). This issue is not exploitable on Red Hat Enterprise Linux 5 if using the default SELinux targeted policy.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A bug was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server.

A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available.
(CVE-2006-5752)

A bug was found in the Apache HTTP Server mod_cache module. On sites where caching is enabled, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-1863)

Users of httpd should upgrade to these updated packages, which contain backported patches to correct these issues. Users should restart Apache after installing this update.

ID	Name	Product	Family	Severity
67533	Oracle Linux 5 : Moderate: / httpd (ELSA-2007-0556)	Nessus	Oracle Linux Local Security Checks	medium
67531	Oracle Linux 4 : httpd (ELSA-2007-0534)	Nessus	Oracle Linux Local Security Checks	medium
67530	Oracle Linux 3 : httpd (ELSA-2007-0533)	Nessus	Oracle Linux Local Security Checks	medium
60221	Scientific Linux Security Update : httpd on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60217	Scientific Linux Security Update : httpd on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
32478	Mac OS X Multiple Vulnerabilities (Security Update 2008-003)	Nessus	MacOS X Local Security Checks	critical
32477	Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
29373	SuSE 10 Security Update : apache2 (ZYPP Patch Number 4669)	Nessus	SuSE Local Security Checks	medium
28282	openSUSE 10 Security Update : apache2 (apache2-4666)	Nessus	SuSE Local Security Checks	medium
28102	Ubuntu 6.06 LTS / 6.10 / 7.04 : apache2 vulnerabilities (USN-499-1)	Nessus	Ubuntu Local Security Checks	medium
27823	GLSA-200711-06 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
27758	Fedora 7 : httpd-2.2.6-1.fc7 (2007-2214)	Nessus	Fedora Local Security Checks	medium
27675	Fedora 7 : httpd-2.2.4-4.1.fc7 (2007-0704)	Nessus	Fedora Local Security Checks	medium
26039	FreeBSD : apache -- multiple vulnerabilities (c115271d-602b-11dc-898c-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	medium
26023	Apache 2.2.x < 2.2.6 Multiple Vulnerabilities (DoS, XSS, Info Disc)	Nessus	Web Servers	medium
25670	Mandrake Linux Security Advisory : apache (MDKSA-2007:140)	Nessus	Mandriva Local Security Checks	medium
25622	RHEL 3 : httpd (RHSA-2007:0533)	Nessus	Red Hat Local Security Checks	medium
25613	CentOS 3 : httpd (CESA-2007:0533)	Nessus	CentOS Local Security Checks	medium
25610	RHEL 5 : httpd (RHSA-2007:0556)	Nessus	Red Hat Local Security Checks	medium
25609	RHEL 4 : httpd (RHSA-2007:0534)	Nessus	Red Hat Local Security Checks	medium
25579	CentOS 5 : httpd (CESA-2007:0556)	Nessus	CentOS Local Security Checks	medium
25578	CentOS 4 : httpd (CESA-2007:0534)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-1863

high

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium