Apache mod_negotiation Multi-Line Filename Upload Vulnerabilities

This script is Copyright (C) 2011-2012 Tenable Network Security, Inc.


Synopsis :

The remote web server may be affected by one or more issues.

Description :

According to its self-reported banner, the version of Apache on the
remote host does not properly escape filenames in 406 responses. A
remote attacker might be able to leverage this to inject arbitrary
HTTP headers or conduct cross-site scripting attacks by uploading a
file with a specially crafted name.

Note that the remote web server may not actually be affected by these
vulnerabilities as Nessus has relied solely on the version number in
the server's banner.

See also :

http://www.securityfocus.com/archive/1/486847/100/0/threaded
https://issues.apache.org/bugzilla/show_bug.cgi?id=46837
http://www.nessus.org/u?164dd6e5

Solution :

Apply the workaround referenced above or upgrade to Apache 2.3.2.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: Web Servers

Nessus Plugin ID: 17692 ()

Bugtraq ID: 27409

CVE ID: CVE-2008-0455
CVE-2008-0456