|
|
|
|
|
|
|
| |
Apache mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String |
|
| This script is Copyright (C) 2004-2010 David Maciejak |
|
|
| Family | Web Servers |
| Nessus Plugin ID | 13651 (mod_ssl_hook_functions_format_string_vuln.nasl) |
| Bugtraq ID | 10736
|
| CVE ID | CVE-2004-0700
|
|
| Description: |
Synopsis :
The remote web server is using a module that is affected by a remote
code execution vulnerability.
Description :
The remote host is using a version vulnerable of mod_ssl which is
older than 2.8.19. There is a format string condition in the log
functions of the remote module which may allow an attacker to execute
arbitrary code on the remote host.
*** Some vendors patched older versions of mod_ssl, so this
*** might be a false positive. Check with your vendor to determine
*** if you have a version of mod_ssl that is patched for this
*** vulnerability
See also :
http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749&w=2
http://marc.theaimsgroup.com/?l=bugtraq&m=109005001205991&w=2
Solution :
Upgrade to mod_ssl version 2.8.19 or newer
Risk factor :
High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
|
|
|
|
|
|
