Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request Entity Too Large" error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated via an HTTP request containing an invalid Content-length value, a similar issue to CVE-2006-3918.

This update fixes multiple bugs in apache :

  - cross-site scripting problem in mod_imap.
    (CVE-2007-5000)

  - cross-site scripting problem in mod_status.
    (CVE-2007-6388)

  - cross-site scripting problem in the ftp proxy module.
    (CVE-2008-0005)

  - cross-site scripting problem in the error page for     status code 413. (CVE-2007-6203)

It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2007-6203)

It was discovered that Apache was vulnerable to a cross-site request forgery (CSRF) in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. (CVE-2007-6420)

It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. (CVE-2008-1678)

It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2008-2168)

It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. (CVE-2008-2364)

It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. (CVE-2008-2939).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple bugs in apache :

  - cross-site scripting problem in mod_imap.
    (CVE-2007-5000)

  - cross-site scripting problem in mod_status.
    (CVE-2007-6388)

  - cross-site scripting problem in the ftp proxy module.
    (CVE-2008-0005)

  - cross-site scripting problem in the error page for     status code 413. (CVE-2007-6203)

  - cross-site scripting problem in mod_proxy_balancer.
    (CVE-2007-6421)

  - A flaw in mod_proxy_balancer allowed attackers to crash     apache. (CVE-2007-6422)

This update fixes multiple bugs in apache :

  - cross site scripting problem in mod_imap (CVE-2007-5000)

  - cross site scripting problem in mod_status     (CVE-2007-6388)

  - cross site scripting problem in the error page for     status code 413 (CVE-2007-6203)

  - cross site scripting problem in mod_proxy_balancer     (CVE-2007-6421)

  - A flaw in mod_proxy_balancer allowed attackers to crash     apache (CVE-2007-6422)

This update fixes multiple bugs in apache :

  - cross site scripting problem in mod_imap (CVE-2007-5000)

  - cross site scripting problem in mod_status     (CVE-2007-6388)

  - cross site scripting problem in the ftp proxy module     (CVE-2008-0005)

  - cross site scripting problem in the error page for     status code 413 (CVE-2007-6203)

  - cross site scripting problem in mod_proxy_balancer     (CVE-2007-6421)

  - A flaw in mod_proxy_balancer allowed attackers to crash     apache (CVE-2007-6422)

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host is affected by the vulnerability described in GLSA-200803-19 (Apache: Multiple vulnerabilities)

    Adrian Pastor and Amir Azam (ProCheckUp) reported that the HTTP Method     specifier header is not properly sanitized when the HTTP return code is     '413 Request Entity too large' (CVE-2007-6203). The mod_proxy_balancer     module does not properly check the balancer name before using it     (CVE-2007-6422). The mod_proxy_ftp does not define a charset in its     answers (CVE-2008-0005). Stefano Di Paola (Minded Security) reported     that filenames are not properly sanitized within the mod_negotiation     module (CVE-2008-0455, CVE-2008-0456).
  Impact :

    A remote attacker could entice a user to visit a malicious URL or send     specially crafted HTTP requests (i.e using Adobe Flash) to perform     Cross-Site Scripting and HTTP response splitting attacks, or conduct a     Denial of Service attack on the vulnerable web server.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of Apache 2.0.x running on the remote host is prior to 2.0.63. It is, therefore, affected by multiple cross-site  scripting vulnerabilities :

  - A cross-site scripting issue involving mod_imap.
    (CVE-2007-5000)

  - A cross-site scripting issue involving 413 error pages     via a malformed HTTP method. (PR 44014 / CVE-2007-6203)

  - A cross-site scripting issue in mod_status involving the     refresh parameter. (CVE-2007-6388)

  - A cross-site scripting issue using UTF-7 encoding in     mod_proxy_ftp exists because it does not define a     charset. (CVE-2008-0005)

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

The version of Apache installed on the remote host is advertising a version older than 2.2.8.  Such versions may be affected by several issues, including :

 - A cross-site scripting issue involving mod_imagemap (CVE-2007-5000).

 - A cross-site scripting issue involving 413 error pages via a malformed HTTP method (PR 44014 / CVE-2007-6203).

 - A cross-site scripting issue in mod_status involving the refresh parameter (CVE-2007-6388).

 - A cross-site scripting issue in mod_proxy_balancer involving the worker route and worker redirect string of the balancer manager (CVE-2007-6421).

 - A denial of service issue in the balancer_handler function in mod_proxy_balancer can be triggered by an authenticated user when a threaded Multi-Processing Module is used (CVE-2007-6422).

 - A cross-site scripting issue using UTF-7 encoding in mod_proxy_ftp exists because it does not define a charset (CVE-2008-0005).

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.8. It is, therefore, affected by the following vulnerabilities :

  - A cross-site scripting issue involving mod_imagemap     (CVE-2007-5000).

  - A cross-site scripting issue involving 413 error pages     via a malformed HTTP method (PR 44014 / CVE-2007-6203).

  - A cross-site scripting issue in mod_status involving     the refresh parameter (CVE-2007-6388).

  - A cross-site scripting issue in mod_proxy_balancer     involving the worker route and worker redirect     string of the balancer manager (CVE-2007-6421).

  - A denial of service issue in the balancer_handler     function in mod_proxy_balancer can be triggered by     an authenticated user when a threaded Multi-     Processing Module is used (CVE-2007-6422).

  - A cross-site scripting issue using UTF-7 encoding     in mod_proxy_ftp exists because it does not     define a charset (CVE-2008-0005).

Note that the remote web server may not actually be affected by these vulnerabilities. Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

ID	Name	Product	Family	Severity
41206	SuSE9 Security Update : Apache 2 (YOU Patch Number 12124)	Nessus	SuSE Local Security Checks	medium
36589	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : apache2 vulnerabilities (USN-731-1)	Nessus	Ubuntu Local Security Checks	medium
31768	SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 5128)	Nessus	SuSE Local Security Checks	medium
31767	openSUSE 10 Security Update : apache2 (apache2-5127)	Nessus	SuSE Local Security Checks	medium
31766	openSUSE 10 Security Update : apache2 (apache2-5126)	Nessus	SuSE Local Security Checks	medium
31765	openSUSE 10 Security Update : apache2 (apache2-5125)	Nessus	SuSE Local Security Checks	medium
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
31445	GLSA-200803-19 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31407	Apache < 2.0.63 Multiple XSS Vulnerabilities	Nessus	Web Servers	medium
4385	Apache < 2.2.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
31118	Apache 2.2.x < 2.2.8 Multiple Vulnerabilities (XSS, DoS)	Nessus	Web Servers	medium
800581	Apache < 2.2.8 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	low

Detections

Analytics

CVE-2007-6203

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium

medium

high

medium

low