The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag (CVE-2016-5003)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)

  - xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response (CVE-2019-17570)

  - The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote     attackers to cause a denial of service (resource consumption) by decompressing a large file containing     zeroes. (CVE-2016-5004)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

ID	Name	Product	Family	Severity
198808	RHEL 5 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198766	RHEL 6 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198745	RHEL 7 : xmlrpc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195410	RHEL 6 : xmlrpc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195397	RHEL 7 : xmlrpc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
195390	RHEL 5 : xmlrpc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2016-5004

medium

Tenable Plugins

critical

high

critical

high

critical

critical