According to its banner, the version of Apache 2.4.x running on the remote host is prior to 2.4.6. It is, therefore, potentially affected by the following vulnerabilities :

 - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests. (CVE-2013-1896)

 - An error exists related to the 'mod_session_dbd' module, flags and session-saving having an unspecified impact. (CVE-2013-2249)

Note that the scanner did not actually test for these issues, but instead has relied on the version in the server's banner.

Apache HTTP SERVER PROJECT reports :

mod_dav: Sending a MERGE request against a URI handled by mod_dav_svn with the source href (sent as part of the request body as XML) pointing to a URI that is not configured for DAV will trigger a segfault.

mod_session_dbd: Make sure that dirty flag is respected when saving sessions, and ensure the session ID is changed each time the session changes. This changes the format of the updatesession SQL statement.
Existing configurations must be changed.

New httpd packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

This update contains the latest release of the Apache HTTP Server, version 2.4.6.

Two security issues are resolved in this update :

  - mod_dav: Sending a MERGE request against a URI handled     by mod_dav_svn could trigger a segfault. (CVE-2013-1896)

  - mod_session_dbd: Make sure that dirty flag is respected     when saving. This changes the format of the     updatesession SQL statement. Existing configurations     must be changed. (CVE-2013-2249)

Numerous bug fixes and minor enhancements are also included; for more information see :

http://www.apache.org/dist/httpd/CHANGES_2.4.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Apache 2.4.x running on the remote host is prior to 2.4.5. It is, therefore, potentially affected by the following vulnerabilities :

  - A denial of service vulnerability exists relating to     the 'mod_dav' module as it relates to MERGE requests.
    (CVE-2013-1896)

  - An error exists related to the 'mod_session_dbd' module,     flags and session-saving having an unspecified impact.
    (CVE-2013-2249)

Note that Nessus did not actually test for these issues, but instead has relied on the version in the server's banner.

According to its self-reported version number, the version of Junos Space running on the remote device is prior to 15.1R1. It is, therefore, affected by multiple vulnerabilities :

  - An error exists within the Apache 'mod_session_dbd'     module, related to save operations for a session, due to     a failure to consider the dirty flag and to require a     new session ID. An unauthenticated, remote attacker can     exploit this to have an unspecified impact.
    (CVE-2013-2249)

  - An unspecified flaw exists in the MySQL Server component     related to error handling that allows a remote attacker     to cause a denial of service condition. (CVE-2013-5908)

  - A flaw exists within the Apache 'mod_dav' module that is     caused when tracking the length of CDATA that has     leading white space. An unauthenticated, remote attacker     can exploit this, via a specially crafted DAV WRITE     request, to cause the service to stop responding.
    (CVE-2013-6438)

  - A flaw exists within the Apache 'mod_log_config' module     that is caused when logging a cookie that has an     unassigned value. An unauthenticated, remote attacker     can exploit this, via a specially crafted request, to     cause the service to crash. (CVE-2014-0098)

  - A flaw exists, related to pixel manipulation, in the     2D component in the Oracle Java runtime that allows an     unauthenticated, remote attacker to impact availability,     confidentiality, and integrity. (CVE-2014-0429)

  - A flaw exists, related to PKCS#1 unpadding, in the     Security component in the Oracle Java runtime that     allows an unauthenticated, remote attacker to gain     knowledge of timing information, which is intended to     be protected by encryption. (CVE-2014-0453)

  - A race condition exists, related to array copying, in     the Hotspot component in the Oracle Java runtime that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2014-0456)

  - A flaw exists in the JNDI component in the Oracle Java     runtime due to missing randomization of query IDs. An     unauthenticated, remote attacker can exploit this to     conduct spoofing attacks. (CVE-2014-0460)

  - A flaw exists in the Mozilla Network Security Services     (NSS) library, which is due to lenient parsing of ASN.1     values involved in a signature and can lead to the     forgery of RSA signatures, such as SSL certificates.
    (CVE-2014-1568)

  - An unspecified flaw exists in the MySQL Server component     related to the CLIENT:SSL:yaSSL subcomponent that allows     a remote attacker to impact integrity. (CVE-2014-6478)

  - Multiple unspecified flaws exist in the MySQL Server     component related to the SERVER:SSL:yaSSL subcomponent     that allow a remote attacker to impact confidentiality,     integrity, and availability. (CVE-2014-6491,     CVE-2014-6500)

  - Multiple unspecified flaws exist in the MySQL Server     component related to the CLIENT:SSL:yaSSL subcomponent     that allow a remote attacker to cause a denial of     service condition. (CVE-2014-6494, CVE-2014-6495,     CVE-2014-6496)

  - An unspecified flaw exists in the MySQL Server component     related to the C API SSL Certificate Handling     subcomponent that allows a remote attacker to disclose     potentially sensitive information. (CVE-2014-6559)

  - An unspecified flaw exists in the MySQL Server component     related to the Server:Compiling subcomponent that allows     an authenticated, remote attacker to cause a denial of     service condition. (CVE-2015-0501)

  - An XML external entity (XXE) injection vulnerability     exists in OpenNMS due to the Castor component accepting     XML external entities from exception messages. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data in a RTC post, to access     local files. (CVE-2015-0975)

  - An unspecified flaw exists in the MySQL Server component     related to the Server:Security:Privileges subcomponent     that allows a remote attacker to disclose potentially     sensitive information. (CVE-2015-2620)

  - A heap buffer overflow condition exists in QEMU in the     pcnet_transmit() function within file hw/net/pcnet.c     due to improper validation of user-supplied input when     handling multi-TMD packets with a length above 4096     bytes. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to gain elevated     privileges from guest to host. (CVE-2015-3209)

  - Multiple cross-site scripting (XSS), SQL injection, and     command injection vulnerabilities exist in Junos Space     that allow an unauthenticated, remote attacker to     execute arbitrary code. (CVE-2015-7753)

The remote host is running an Apache HTTP server. Versions 2.4.1 to 2.4.4 inclusive are vulnerable to the following vulnerabilities :

  - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests. (CVE-2013-1896)

  - An error exists related to the 'mod_session_dbd' module, flags and session-saving having an unspecified impact.(CVE-2013-2249). 

The remote host is running a Apache HTTP server. Versions earlier than 2.4.5 are vulnerable to the following vulnerabilities :

  - A denial of service vulnerability exists relating to the 'mod_dav' module as it relates to MERGE requests. (CVE-2013-1896)

  - An error exists related to the 'mod_session_dbd' module, flags and session-saving having an unspecified impact.(CVE-2013-2249).

ID	Name	Product	Family	Published	Updated	Severity
98903	Apache 2.4.x < 2.4.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	1/9/2019	3/14/2023	critical
68990	FreeBSD : apache24 -- several vulnerabilities (ca4d63fb-f15c-11e2-b183-20cf30e32f6d)	Nessus	FreeBSD Local Security Checks	7/22/2013	1/6/2021	high
69225	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : httpd (SSA:2013-218-02)	Nessus	Slackware Local Security Checks	8/7/2013	1/14/2021	high
69290	Fedora 19 : httpd-2.4.6-2.fc19 (2013-13994)	Nessus	Fedora Local Security Checks	8/10/2013	1/11/2021	high
69014	Apache 2.4.x < 2.4.5 Multiple Vulnerabilities	Nessus	Web Servers	7/23/2013	4/11/2022	critical
69380	Fedora 18 : httpd-2.4.6-2.fc18 (2013-13922)	Nessus	Fedora Local Security Checks	8/20/2013	1/11/2021	high
91778	Juniper Junos Space < 15.1R1 Multiple Vulnerabilities (JSA10698)	Nessus	Junos Local Security Checks	6/23/2016	7/12/2018	critical
6942	Apache 2.4.1 to 2.4.4 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	7/23/2013	3/6/2019	high
801401	Apache 2.4 < 2.4.5 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	7/23/2013		high

Detections

Analytics

Plugins Search

critical

high

high

high

critical

high

critical

high

high