The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2709 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2 serves as an update     for Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1, and includes bug fixes, which     are documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before     using it when processing certain headers related to digest authentication. A remote attacker could     possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash     by sending specially crafted requests to a server. (CVE-2017-9788)

    * It was discovered that in httpd 2.4, the internal API function ap_some_auth_required() could incorrectly     indicate that a request was authenticated even when no authentication was used. An httpd module using this     API function could consequently allow access that should have been denied. (CVE-2015-3185)

    * A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-     middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted     traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite.
    (CVE-2016-2183)

    Red Hat would like to thank OpenVPN for reporting CVE-2016-2183. Upstream acknowledges Karthikeyan     Bhargavan (Inria) and Gatan Leurent (Inria) as the original reporters of CVE-2016-2183.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : Red Hat JBoss Core Services (RHSA-2017:2709)

critical Nessus Plugin ID 103240

Version 3.11