Test Kennung:	1.3.6.1.4.1.25623.1.0.15554
Kategorie:	Web Servers
Titel:	Apache HTTP Server 'mod_include' Privilege Escalation Vulnerability
Zusammenfassung:	The remote web server appears to be running a version; of Apache HTTP Server that is older than version 1.3.33.
Beschreibung:	Summary: The remote web server appears to be running a version of Apache HTTP Server that is older than version 1.3.33. Vulnerability Insight: This version is vulnerable to a local buffer overflow in the get_tag() function of the module 'mod_include' when a specially crafted document with malformed server-side includes is requested though an HTTP session. Vulnerability Impact: Successful exploitation can lead to execution of arbitrary code with escalated privileges, but requires that server-side includes (SSI) is enabled. Solution: Disable SSI or update to a newer version when available. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2004-0940 BugTraq ID: 11471 http://www.securityfocus.com/bid/11471 Debian Security Information: DSA-594 (Google Search) http://www.debian.org/security/2004/dsa-594 http://www.mandriva.com/security/advisories?name=MDKSA-2004:134 https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3Ccvs.httpd.apache.org%3E https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e@%3Ccvs.httpd.apache.org%3E http://marc.info/?l=bugtraq&m=109906660225051&w=2 http://www.redhat.com/support/errata/RHSA-2004-600.html http://www.redhat.com/support/errata/RHSA-2005-816.html http://securitytracker.com/id?1011783 http://secunia.com/advisories/12898/ http://secunia.com/advisories/19073 http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1 http://www.vupen.com/english/advisories/2006/0789 XForce ISS Database: apache-modinclude-bo(17785) https://exchange.xforce.ibmcloud.com/vulnerabilities/17785
Copyright	Copyright (C) 2004 David Maciejak

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.