mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.

According to its banner, the version of Apache 2.4.x running on the remote host is prior to 2.4.6. It is, therefore, potentially affected by the following vulnerabilities :

 - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests. (CVE-2013-1896)

 - An error exists related to the 'mod_session_dbd' module, flags and session-saving having an unspecified impact. (CVE-2013-2249)

Note that the scanner did not actually test for these issues, but instead has relied on the version in the server's banner.

According to its self-reported version number, the version of Junos Space running on the remote device is prior to 15.1R1. It is, therefore, affected by multiple vulnerabilities :

  - An error exists within the Apache 'mod_session_dbd'     module, related to save operations for a session, due to     a failure to consider the dirty flag and to require a     new session ID. An unauthenticated, remote attacker can     exploit this to have an unspecified impact.
    (CVE-2013-2249)

  - An unspecified flaw exists in the MySQL Server component     related to error handling that allows a remote attacker     to cause a denial of service condition. (CVE-2013-5908)

  - A flaw exists within the Apache 'mod_dav' module that is     caused when tracking the length of CDATA that has     leading white space. An unauthenticated, remote attacker     can exploit this, via a specially crafted DAV WRITE     request, to cause the service to stop responding.
    (CVE-2013-6438)

  - A flaw exists within the Apache 'mod_log_config' module     that is caused when logging a cookie that has an     unassigned value. An unauthenticated, remote attacker     can exploit this, via a specially crafted request, to     cause the service to crash. (CVE-2014-0098)

  - A flaw exists, related to pixel manipulation, in the     2D component in the Oracle Java runtime that allows an     unauthenticated, remote attacker to impact availability,     confidentiality, and integrity. (CVE-2014-0429)

  - A flaw exists, related to PKCS#1 unpadding, in the     Security component in the Oracle Java runtime that     allows an unauthenticated, remote attacker to gain     knowledge of timing information, which is intended to     be protected by encryption. (CVE-2014-0453)

  - A race condition exists, related to array copying, in     the Hotspot component in the Oracle Java runtime that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2014-0456)

  - A flaw exists in the JNDI component in the Oracle Java     runtime due to missing randomization of query IDs. An     unauthenticated, remote attacker can exploit this to     conduct spoofing attacks. (CVE-2014-0460)

  - A flaw exists in the Mozilla Network Security Services     (NSS) library, which is due to lenient parsing of ASN.1     values involved in a signature and can lead to the     forgery of RSA signatures, such as SSL certificates.
    (CVE-2014-1568)

  - An unspecified flaw exists in the MySQL Server component     related to the CLIENT:SSL:yaSSL subcomponent that allows     a remote attacker to impact integrity. (CVE-2014-6478)

  - Multiple unspecified flaws exist in the MySQL Server     component related to the SERVER:SSL:yaSSL subcomponent     that allow a remote attacker to impact confidentiality,     integrity, and availability. (CVE-2014-6491,     CVE-2014-6500)

  - Multiple unspecified flaws exist in the MySQL Server     component related to the CLIENT:SSL:yaSSL subcomponent     that allow a remote attacker to cause a denial of     service condition. (CVE-2014-6494, CVE-2014-6495,     CVE-2014-6496)

  - An unspecified flaw exists in the MySQL Server component     related to the C API SSL Certificate Handling     subcomponent that allows a remote attacker to disclose     potentially sensitive information. (CVE-2014-6559)

  - An unspecified flaw exists in the MySQL Server component     related to the Server:Compiling subcomponent that allows     an authenticated, remote attacker to cause a denial of     service condition. (CVE-2015-0501)

  - An XML external entity (XXE) injection vulnerability     exists in OpenNMS due to the Castor component accepting     XML external entities from exception messages. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data in a RTC post, to access     local files. (CVE-2015-0975)

  - An unspecified flaw exists in the MySQL Server component     related to the Server:Security:Privileges subcomponent     that allows a remote attacker to disclose potentially     sensitive information. (CVE-2015-2620)

  - A heap buffer overflow condition exists in QEMU in the     pcnet_transmit() function within file hw/net/pcnet.c     due to improper validation of user-supplied input when     handling multi-TMD packets with a length above 4096     bytes. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to gain elevated     privileges from guest to host. (CVE-2015-3209)

  - Multiple cross-site scripting (XSS), SQL injection, and     command injection vulnerabilities exist in Junos Space     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2015-7753)

This update contains the latest release of the Apache HTTP Server, version 2.4.6.

Two security issues are resolved in this update :

  - mod_dav: Sending a MERGE request against a URI handled     by mod_dav_svn could trigger a segfault. (CVE-2013-1896)

  - mod_session_dbd: Make sure that dirty flag is respected     when saving. This changes the format of the     updatesession SQL statement. Existing configurations     must be changed. (CVE-2013-2249)

Numerous bug fixes and minor enhancements are also included; for more information see :

http://www.apache.org/dist/httpd/CHANGES_2.4.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New httpd packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

The remote host is running a Apache HTTP server. Versions earlier than 2.4.5 are vulnerable to the following vulnerabilities :

  - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests. (CVE-2013-1896)

  - An error exists related to the 'mod_session_dbd' module, flags and session-saving having an unspecified impact.(CVE-2013-2249).

The remote host is running an Apache HTTP server. Versions 2.4.1 to 2.4.4 inclusive are vulnerable to the following vulnerabilities :

  - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests. (CVE-2013-1896)

  - An error exists related to the 'mod_session_dbd' module, flags and session-saving having an unspecified impact.(CVE-2013-2249). 

According to its banner, the version of Apache 2.4.x running on the remote host is prior to 2.4.5. It is, therefore, potentially affected by the following vulnerabilities :

  - A denial of service vulnerability exists relating to     the 'mod_dav' module as it relates to MERGE requests.
    (CVE-2013-1896)

  - An error exists related to the 'mod_session_dbd' module,     flags and session-saving having an unspecified impact.
    (CVE-2013-2249)

Note that Nessus did not actually test for these issues, but instead has relied on the version in the server's banner.

Apache HTTP SERVER PROJECT reports :

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.

mod_session_dbd: Make sure that dirty flag is respected when saving sessions, and ensure the session ID is changed each time the session changes. This changes the format of the updatesession SQL statement.
Existing configurations must be changed.

ID	Name	Product	Family	Severity
98903	Apache 2.4.x < 2.4.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
91778	Juniper Junos Space < 15.1R1 Multiple Vulnerabilities (JSA10698)	Nessus	Junos Local Security Checks	critical
69380	Fedora 18 : httpd-2.4.6-2.fc18 (2013-13922)	Nessus	Fedora Local Security Checks	high
69290	Fedora 19 : httpd-2.4.6-2.fc19 (2013-13994)	Nessus	Fedora Local Security Checks	high
69225	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : httpd (SSA:2013-218-02)	Nessus	Slackware Local Security Checks	high
801401	Apache 2.4 < 2.4.5 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	high
6942	Apache 2.4.1 to 2.4.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
69014	Apache 2.4.x < 2.4.5 Multiple Vulnerabilities	Nessus	Web Servers	critical
68990	FreeBSD : apache24 -- several vulnerabilities (ca4d63fb-f15c-11e2-b183-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-2249

critical

Tenable Plugins

critical

critical

high

high

high

high

high

critical

high