Detections
Analytics
Apache < 1.3.27 Multiple Vulnerabilities (DoS, XSS)
high Nessus Plugin ID 11137
Language:
Synopsis
The remote web server is affected by multiple vulnerabilities.Description
The remote host is running a version of Apache web server prior to 1.3.27. It is, therefore, affected by multiple vulnerabilities :- There is a cross-site scripting vulnerability caused by a failure to filter HTTP/1.1 'Host' headers that are sent by browsers.
- A vulnerability in the handling of the Apache scorecard could allow an attacker to cause a denial of service.
- A buffer overflow vulnerability exists in the 'support/ab.c' read_connection() function. The ab.c file is a benchmarking support utility that is provided with the Apache web server.
Solution
Upgrade to Apache web server version 1.3.27 or later.See Also
https://seclists.org/bugtraq/2002/Oct/199
http://www.nessus.org/u?767573c2
Plugin Details
Severity: High
ID: 11137
File Name: apache_1_3_27.nasl
Version: 1.43
Type: remote
Family: Web Servers
Published: 10/4/2002
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.0
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:apache:http_server
Required KB Items: installed_sw/Apache
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 10/2/2002