Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote attackers to read .DS_Store files and files beginning with ".ht" using alternate capitalization.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

The remote host seems to be running Mac OS X or Mac OS X Server. 

There is a flaw in the remote web server that allows an attacker to obtain the source code of any given file on the remote web server by reading it through its data fork directly.  An attacker may exploit this flaw to obtain the source code of remote scripts.

The remote host is missing Security Update 2004-12-02. This security update contains a number of enhancements for the following programs :

 - Apache
 - Apache2
 - AppKit
 - Cyrus IMAP
 - HIToolbox
 - Kerberos
 - Postfix
 - PSNormalizer
 - QuickTime Streaming Server
 - Safari
 - Terminal

The remote host is missing Security Update 2004-12-02. This security update contains a number of fixes for the following programs :

  - Apache
  - Apache2
  - AppKit
  - Cyrus IMAP
  - HIToolbox
  - Kerberos
  - Postfix
  - PSNormalizer
  - QuickTime Streaming Server
  - Safari
  - Terminal

These programs contain multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

ID	Name	Product	Family	Severity
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	critical
15927	Apache on Mac OS X HFS+ Arbitrary File Source Disclosure	Nessus	Web Servers	medium
2444	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus Network Monitor	Web Clients	high
15898	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2004-1083

high

Tenable Plugins

critical

medium

high

high