Detections
Analytics
Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : apache2 vulnerabilities (USN-731-1)
medium Nessus Plugin ID 36589
Synopsis
The remote Ubuntu host is missing one or more security-related patches.Description
It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2007-6203)It was discovered that Apache was vulnerable to a cross-site request forgery (CSRF) in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. (CVE-2007-6420)
It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. (CVE-2008-1678)
It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. (CVE-2008-2168)
It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. (CVE-2008-2364)
It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. (CVE-2008-2939).
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 36589
File Name: ubuntu_USN-731-1.nasl
Version: 1.20
Type: local
Agent: unix
Family: Ubuntu Local Security Checks
Published: 4/23/2009
Updated: 1/19/2021
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P
Vulnerability Information
CPE: p-cpe:/a:canonical:ubuntu_linux:apache2, p-cpe:/a:canonical:ubuntu_linux:apache2-common, p-cpe:/a:canonical:ubuntu_linux:apache2-doc, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-event, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-perchild, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-prefork, p-cpe:/a:canonical:ubuntu_linux:apache2-mpm-worker, p-cpe:/a:canonical:ubuntu_linux:apache2-prefork-dev, p-cpe:/a:canonical:ubuntu_linux:apache2-src, p-cpe:/a:canonical:ubuntu_linux:apache2-threaded-dev, p-cpe:/a:canonical:ubuntu_linux:apache2-utils, p-cpe:/a:canonical:ubuntu_linux:apache2.2-common, p-cpe:/a:canonical:ubuntu_linux:libapr0, p-cpe:/a:canonical:ubuntu_linux:libapr0-dev, cpe:/o:canonical:ubuntu_linux:6.06:-:lts, cpe:/o:canonical:ubuntu_linux:7.10, cpe:/o:canonical:ubuntu_linux:8.04:-:lts
Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/10/2009
Reference Information
CVE: CVE-2007-6203, CVE-2007-6420, CVE-2008-1678, CVE-2008-2168, CVE-2008-2364, CVE-2008-2939