CVE-2007-6388MEDIUM
Description
Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
http://docs.info.apple.com/article.html?artnum=307562
http://httpd.apache.org/security/vulnerabilities_13.html
http://httpd.apache.org/security/vulnerabilities_20.html
http://httpd.apache.org/security/vulnerabilities_22.html
http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00004.html
http://lists.vmware.com/pipermail/security-announce/2009/000062.html
http://marc.info/?l=bugtraq&m=130497311408250&w=2
http://secunia.com/advisories/28467
http://secunia.com/advisories/28471
http://secunia.com/advisories/28526
http://secunia.com/advisories/28607
http://secunia.com/advisories/28749
http://secunia.com/advisories/28922
http://secunia.com/advisories/28965
http://secunia.com/advisories/28977
http://secunia.com/advisories/29420
http://secunia.com/advisories/29504
http://secunia.com/advisories/29640
http://secunia.com/advisories/29806
http://secunia.com/advisories/29988
http://secunia.com/advisories/30356
http://secunia.com/advisories/30430
http://secunia.com/advisories/30732
http://secunia.com/advisories/31142
http://secunia.com/advisories/32800
http://secunia.com/advisories/33200
http://securityreason.com/securityalert/3541
http://securitytracker.com/id?1019154
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.595748
http://sunsolve.sun.com/search/document.do?assetkey=1-26-233623-1
http://support.avaya.com/elmodocs2/security/ASA-2008-032.htm
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=689039
http://www.fujitsu.com/global/support/software/security/products-f/interstage-200808e.html
http://www.mandriva.com/security/advisories?name=MDVSA-2008:014
http://www.mandriva.com/security/advisories?name=MDVSA-2008:015
http://www.mandriva.com/security/advisories?name=MDVSA-2008:016
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html
http://www.redhat.com/support/errata/RHSA-2008-0004.html
http://www.redhat.com/support/errata/RHSA-2008-0005.html
http://www.redhat.com/support/errata/RHSA-2008-0006.html
http://www.redhat.com/support/errata/RHSA-2008-0007.html
http://www.redhat.com/support/errata/RHSA-2008-0008.html
http://www.redhat.com/support/errata/RHSA-2008-0009.html
http://www.redhat.com/support/errata/RHSA-2008-0261.html
http://www.securityfocus.com/archive/1/488082/100/0/threaded
http://www.securityfocus.com/archive/1/494428/100/0/threaded
http://www.securityfocus.com/archive/1/498523/100/0/threaded
http://www.securityfocus.com/archive/1/505990/100/0/threaded
http://www.securityfocus.com/bid/27237
http://www.ubuntu.com/usn/usn-575-1
http://www.us-cert.gov/cas/techalerts/TA08-150A.html
http://www.vupen.com/english/advisories/2008/0047
http://www.vupen.com/english/advisories/2008/0447/references
http://www.vupen.com/english/advisories/2008/0554
http://www.vupen.com/english/advisories/2008/0809/references
http://www.vupen.com/english/advisories/2008/0924/references
http://www.vupen.com/english/advisories/2008/0986/references
http://www.vupen.com/english/advisories/2008/1224/references
http://www.vupen.com/english/advisories/2008/1623/references
http://www.vupen.com/english/advisories/2008/1697
http://www-1.ibm.com/support/docview.wss?uid=swg1PK62966
http://www-1.ibm.com/support/docview.wss?uid=swg1PK63273
http://www-1.ibm.com/support/docview.wss?uid=swg24019245
http://www-1.ibm.com/support/search.wss?rs=0&q=PK59667&apar=only
http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2008/05/023342-01.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/39472
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10272
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00541.html
https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00562.html
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 69301 | Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities | Nessus | Web Servers | critical |
| 67633 | Oracle Linux 5 : httpd (ELSA-2008-0008) | Nessus | Oracle Linux Local Security Checks | medium |
| 67632 | Oracle Linux 4 : httpd (ELSA-2008-0006) | Nessus | Oracle Linux Local Security Checks | medium |
| 67631 | Oracle Linux 3 : httpd (ELSA-2008-0005) | Nessus | Oracle Linux Local Security Checks | medium |
| 63857 | RHEL 3 / 4 : Proxy Server (RHSA-2008:0523) | Nessus | Red Hat Local Security Checks | high |
| 63853 | RHEL 4 : Proxy Server (RHSA-2008:0263) | Nessus | Red Hat Local Security Checks | medium |
| 60345 | Scientific Linux Security Update : httpd on SL3.x, SL4.x, SL5.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | medium |
| 43837 | RHEL 3 / 4 : Satellite Server (RHSA-2008:0524) | Nessus | Red Hat Local Security Checks | critical |
| 43835 | RHEL 4 : Satellite Server (RHSA-2008:0261) | Nessus | Red Hat Local Security Checks | critical |
| 43666 | CentOS 5 : httpd (CESA-2008:0008) | Nessus | CentOS Local Security Checks | medium |
| 41207 | SuSE9 Security Update : Apache (YOU Patch Number 12125) | Nessus | SuSE Local Security Checks | medium |
| 41206 | SuSE9 Security Update : Apache 2 (YOU Patch Number 12124) | Nessus | SuSE Local Security Checks | medium |
| 39378 | HP-UX PHSS_38148 : s700_800 11.X OV NNM7.53 IA-64 Intermediate Patch 19 | Nessus | HP-UX Local Security Checks | high |
| 39377 | HP-UX PHSS_38147 : s700_800 11.X OV NNM7.53 PA-RISC Intermediate Patch 19 | Nessus | HP-UX Local Security Checks | high |
| 36524 | Mandriva Linux Security Advisory : apache (MDVSA-2008:016) | Nessus | Mandriva Local Security Checks | medium |
| 34952 | HP-UX PHSS_38761 : s700_800 11.X OV NNM7.01 Intermediate Patch 12 | Nessus | HP-UX Local Security Checks | critical |
| 33747 | Slackware 12.0 / 12.1 / current : httpd (SSA:2008-210-02) | Nessus | Slackware Local Security Checks | medium |
| 32478 | Mac OS X Multiple Vulnerabilities (Security Update 2008-003) | Nessus | MacOS X Local Security Checks | critical |
| 32477 | Mac OS X 10.5.x < 10.5.3 Multiple Vulnerabilities | Nessus | MacOS X Local Security Checks | critical |
| 31768 | SuSE 10 Security Update : Apache 2 (ZYPP Patch Number 5128) | Nessus | SuSE Local Security Checks | medium |
| 31767 | openSUSE 10 Security Update : apache2 (apache2-5127) | Nessus | SuSE Local Security Checks | medium |
| 31766 | openSUSE 10 Security Update : apache2 (apache2-5126) | Nessus | SuSE Local Security Checks | medium |
| 31765 | openSUSE 10 Security Update : apache2 (apache2-5125) | Nessus | SuSE Local Security Checks | medium |
| 31605 | Mac OS X Multiple Vulnerabilities (Security Update 2008-002) | Nessus | MacOS X Local Security Checks | critical |
| 31408 | Apache 1.3.x < 1.3.41 Multiple Vulnerabilities (DoS, XSS) | Nessus | Web Servers | medium |
| 31407 | Apache < 2.0.63 Multiple XSS Vulnerabilities | Nessus | Web Servers | medium |
| 4385 | Apache < 2.2.8 Multiple Vulnerabilities | Nessus Network Monitor | Web Servers | high |
| 31118 | Apache 2.2.x < 2.2.8 Multiple Vulnerabilities (XSS, DoS) | Nessus | Web Servers | medium |
| 31105 | Fedora 7 : httpd-2.2.8-1.fc7 (2008-1711) | Nessus | Fedora Local Security Checks | medium |
| 31103 | Fedora 8 : httpd-2.2.8-1.fc8 (2008-1695) | Nessus | Fedora Local Security Checks | medium |
| 31100 | Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : apache (SSA:2008-045-02) | Nessus | Slackware Local Security Checks | medium |
| 31099 | Slackware 12.0 / current : httpd (SSA:2008-045-01) | Nessus | Slackware Local Security Checks | medium |
| 30184 | Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : apache2 vulnerabilities (USN-575-1) | Nessus | Ubuntu Local Security Checks | medium |
| 29977 | RHEL 5 : httpd (RHSA-2008:0008) | Nessus | Red Hat Local Security Checks | medium |
| 29976 | RHEL 4 : httpd (RHSA-2008:0006) | Nessus | Red Hat Local Security Checks | medium |
| 29975 | RHEL 3 : httpd (RHSA-2008:0005) | Nessus | Red Hat Local Security Checks | medium |
| 29974 | RHEL 2.1 : apache (RHSA-2008:0004) | Nessus | Red Hat Local Security Checks | medium |
| 29967 | CentOS 4 : httpd (CESA-2008:0006) | Nessus | CentOS Local Security Checks | medium |
| 29966 | CentOS 3 : httpd (CESA-2008:0005) | Nessus | CentOS Local Security Checks | medium |
| 800581 | Apache < 2.2.8 Multiple Vulnerabilities | Log Correlation Engine | Web Servers | low |