Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities as noted in the July 2016 CPU advisory.

The remote web server is affected by an information disclosure vulnerability due to the ETag header providing sensitive information that could aid an attacker, such as the inode number of requested files.

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities :

  - (CVE-2003-1418)

  - A denial of service vulnerability exists in libxml2,     related to the xmlParserHandlePEReference() function in     file parser.c, due to loading external parameter     entities without regard to entity substitution or     validation being enabled, as in the case of entity     substitution in the doctype prolog. An unauthenticated,     remote attacker can exploit this, via specially crafted     XML content, to exhaust the system CPU, memory, or file     descriptor resources. (CVE-2014-0191)

  - An unspecified vulnerability exists in the Web Listener     component that allows an unauthenticated, remote     attacker to impact availability. (CVE-2015-1829)

  -  (CVE-2015-2808)

  - An unspecified vulnerability exists in the OSSL Module     that allows an unauthenticated, remote attacker to     impact confidentiality. (CVE-2015-4812)

  - An unspecified vulnerability exists in the Web Listener     component that allows an authenticated, remote attacker     to impact confidentiality. (CVE-2015-4914)

  - (CVE-2016-2183)

The Apache2 webserver was updated to fix various issues.

The following feature was added :

  - Provide support for the tunneling of web socket     connections to a backend websockets server.
    (FATE#316880) The following security issues have been     fixed :

  - The mod_headers module in the Apache HTTP Server 2.2.22     allowed remote attackers to bypass 'RequestHeader unset'     directives by placing a header in the trailer portion of     data sent with chunked transfer coding. The fix also     adds a 'MergeTrailers' directive to restore legacy     behavior. (CVE-2013-5704)

  - The cache_merge_headers_out function in     modules/cache/cache_util.c in the mod_cache module in     the Apache HTTP Server allowed remote attackers to cause     a denial of service (NULL pointer dereference and     application crash) via an empty HTTP Content-Type     header. (CVE-2014-3581)

  - Apache HTTP Server allowed remote attackers to obtain     sensitive information via (1) the ETag header, which     reveals the inode number, or (2) multipart MIME     boundary, which reveals child process IDs (PID). We so     far assumed that this not useful to attackers, the fix     is basically just reducing potential information leaks.
    (CVE-2003-1418)

The following bugs have been fixed :

  - Treat the 'server unavailable' condition as a transient     error with all LDAP SDKs. (bsc#904427)

  - Fixed a segmentation fault at startup if the certs are     shared across > 1 server_rec. (bsc#907339)

The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities in the Web Listener subcomponent :

  - An integer overflow condition exists in libxml2 within     file xpath.c, related to XPath expressions when adding a     new namespace note. An unauthenticated, remote attacker     can exploit this, via a crafted XML file, to cause a     denial of service condition or the execution of arbitary     code. (CVE-2011-1944)

  - An integer overflow condition exists in the HTTP server,     specifically in the ap_pregsub() function within file     server/util.c, when the mod_setenvif module is enabled.
    A local attacker can exploit this to gain elevated     privileges by using an .htaccess file with a crafted     combination of SetEnvIf directives and HTTP request     headers. (CVE-2011-3607)

  - A flaw exists in libxml2, known as the 'internal entity     expansion' with linear complexity issue, that allows     specially crafted XML files to consume excessive CPU and     memory resources. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     by using a specially crafted XML file containing an     entity declaration with long replacement text and many     references to this entity. (CVE-2013-0338)

  - An out-of-bounds read error exists in libxml2 within     file parser.c due to a failure to check for the     XML_PARSER_EOF state. An unauthenticated, remote     attacker can exploit this, via a specially crafted     document that ends abruptly, to cause a denial of     service condition. (CVE-2013-2877)

  - A flaw exists within the mod_headers module in the     HTTP server which allows bypassing the 'RequestHeader     unset' directives. An unauthenticated, remote attacker     can exploit this to inject arbitrary headers. This is     done by placing a header in the trailer portion of data     being sent using chunked transfer encoding.
    (CVE-2013-5704)

  - A flaw exists in the dav_xml_get_cdata() function in     file main/util.c within the HTTP server mod_dav module     due to incorrect stripping of whitespace characters from     the CDATA sections. An unauthenticated, remote attacker     via a specially crafted DAV WRITE request, can exploit     this to cause a denial of service condition.
    (CVE-2013-6438)

  - A flaw exists in the log_cookie() function in file     mod_log_config.c within the HTTP server mod_log_config     module due to improper handling of specially crafted     cookies during truncation. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition via a segmentation fault. (CVE-2014-0098)

  - A flaw exists in libxml2, specifically in the     xmlParserHandlePEReference() function in file parser.c,     due to loading external parameter entities even when     entity substitution is disabled. An unauthenticated,     remote attacker can exploit this issue, via a specially     crafted XML file, to conduct XML External Entity (XXE)     attacks that exhaust CPU and memory resources, resulting     in a denial of service condition. (CVE-2014-0191)

  - A race condition exists in the HTTP server within the     mod_status module when using a threaded Multi-Processing     Module (MPM). If an unauthenticated, remote attacker is     able to access status pages served by mod_status, the     attacker can exploit this issue, by sending specially     crafted requests, to cause the httpd child process to     crash or possibly execute arbitrary code with the     privileges of the user running the web server.
    (CVE-2014-0226)

  - An unspecified flaw exists in the Web Listener     subcomponent that allows an unauthenticated, remote     attacker to impact confidentiality, integrity, and     availability. (CVE-2014-6571)

  - An unspecified flaw exists in the J2EE subcomponent that     allows an unauthenticated, remote attacker to disclose     potentially sensitive information. (CVE-2015-0372)

  - An unspecified flaw exists in the Web Listener     subcomponent that allows an unauthenticated, remote     attacker to cause a denial of service condition.
    (CVE-2015-0386)

ID	Name	Product	Family	Severity
92542	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (July 2016 CPU)	Nessus	Web Servers	low
88098	Apache Server ETag Header Information Disclosure	Nessus	Web Servers	medium
86569	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (October 2015 CPU)	Nessus	Web Servers	high
82657	SuSE 11.3 Security Update : apache2 (SAT Patch Number 10533)	Nessus	SuSE Local Security Checks	medium
81002	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2015 CPU)	Nessus	Web Servers	high

Detections

Analytics

CVE-2003-1418

critical

Tenable Plugins

low

medium

high

medium

high