Detections
Analytics

Debian DSA-181-1 : libapache-mod-ssl - XSS

high Nessus Plugin ID 15018

Synopsis

The remote Debian host is missing a security-related update.

Description

Joe Orton discovered a cross site scripting problem in mod_ssl, an Apache module that adds Strong cryptography (i.e. HTTPS support) to the webserver. The module will return the server name unescaped in the response to an HTTP request on an SSL port.

Like the other recent Apache XSS bugs, this only affects servers using a combination of 'UseCanonicalName off' (default in the Debian package of Apache) and wildcard DNS. This is very unlikely to happen, though.
Apache 2.0/mod_ssl is not vulnerable since it already escapes this HTML.

With this setting turned on, whenever Apache needs to construct a self-referencing URL (a URL that refers back to the server the response is coming from) it will use ServerName and Port to form a 'canonical' name. With this setting off, Apache will use the hostname:port that the client supplied, when possible. This also affects SERVER_NAME and SERVER_PORT in CGI scripts.

Solution

Upgrade the libapache-mod-ssl package.

This problem has been fixed in version 2.8.9-2.1 for the current stable distribution (woody), in version 2.4.10-1.3.9-1potato4 for the old stable distribution (potato) and version 2.8.9-2.3 for the unstable distribution (sid).

See Also

http://www.debian.org/security/2002/dsa-181

Plugin Details

Severity: High

ID: 15018

File Name: debian_DSA-181.nasl

Version: 1.19

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libapache-mod-ssl, cpe:/o:debian:debian_linux:2.2, cpe:/o:debian:debian_linux:3.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/22/2002

Reference Information

CVE: CVE-2002-1157

BID: 6029

DSA: 181