modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."

This update for apache2 fixes the following issues :

  - Allow disabling SNI on proxy connections using 'SetEnv     proxy-disable-sni 1' in the configuration files.
    (bsc#1052830)

  - Allow ECDH again in mod_ssl, it had been incorrectly     disabled with the 2.2.34 update. (bsc#1064561) Following     security issue has been fixed :

  - CVE-2017-9798: A use-after-free in the OPTIONS command     could be used by attackers to disclose memory of the     apache server process, when htaccess uses incorrect     Limit statement. (bsc#1058058) Additionally, references     to the following security issues, fixed by the previous     version-update of apache2 to Apache HTTPD 2.2.34 have     been added :

  - CVE-2017-7668: The HTTP strict parsing introduced a bug     in token list parsing, which allowed ap_find_token() to     search past the end of its input string. By maliciously     crafting a sequence of request headers, an attacker may     have be able to cause a segmentation fault, or to force     ap_find_token() to return an incorrect value.
    (bsc#1045061)

  - CVE-2017-3169: mod_ssl may have de-referenced a NULL     pointer when third-party modules call     ap_hook_process_connection() during an HTTP request to     an HTTPS port allowing for DoS. (bsc#1045062)

  - CVE-2017-3167: Use of the ap_get_basic_auth_pw() by     third-party modules outside of the authentication phase     may have lead to authentication requirements being     bypassed. (bsc#1045065)

  - CVE-2017-7679: mod_mime could have read one byte past     the end of a buffer when sending a malicious     Content-Type response header. (bsc#1045060)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Oracle HTTP Server installed on the remote host is potentially affected by multiple vulnerabilities. 

Note that Nessus did not verify if patches or workarounds have been applied.

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

According to its banner, the version of Apache 2.0.x running on the remote host is prior to 2.0.64. It is, therefore, affected by the following vulnerabilities :

  - An unspecified error exists in the handling of requests     without a path segment. (CVE-2010-1452)

  - Several modules, including 'mod_deflate', are     vulnerable to a denial of service attack as the     server can be forced to utilize CPU time compressing     a large file after client disconnect. (CVE-2009-1891)

  - An unspecified error exists in 'mod_proxy' related to     filtration of authentication credentials.     (CVE-2009-3095)  
  - A NULL pointer dereference issue exists in     'mod_proxy_ftp' in some error handling paths.
    (CVE-2009-3094)

  - An error exists in 'mod_ssl' making the server     vulnerable to the TLC renegotiation prefix injection     attack. (CVE-2009-3555)

  - An error exists in the handling of subrequests such     that the parent request headers may be corrupted.
    (CVE-2010-0434)

  - An error exists in 'mod_proxy_http' when handling excessive     interim responses making it vulnerable to a denial of     service attack. (CVE-2008-2364)

  - An error exists in 'mod_isapi' that allows the module     to be unloaded too early, which leaves orphaned callback     pointers. (CVE-2010-0425)

  - An error exists in 'mod_proxy_ftp' when wildcards are     in an FTP URL, which allows for cross-site scripting     attacks. (CVE-2008-2939)

Note that the remote web server may not actually be affected by these vulnerabilities.  Nessus did not try to determine whether the affected modules are in use or to check for the issues themselves.

According to its banner, the version of Apache 2.2.x running on the remote host is prior to 2.2.15. It is, therefore, potentially affected by multiple vulnerabilities :

  - A TLS renegotiation prefix injection attack is possible.     (CVE-2009-3555)

  - The 'mod_proxy_ajp' module returns the wrong status code     if it encounters an error which causes the back-end     server to be put into an error state. (CVE-2010-0408)

  - The 'mod_isapi' attempts to unload the 'ISAPI.dll' when     it encounters various error states which could leave     call-backs in an undefined state. (CVE-2010-0425)

  - A flaw in the core sub-request process code can lead to     sensitive information from a request being handled by     the wrong thread if a multi-threaded environment is     used. (CVE-2010-0434)

  - Added 'mod_reqtimeout' module to mitigate Slowloris     attacks. (CVE-2007-6750)

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. mod_ssl: A partial fix for the TLS renegotiation prefix injection attack by rejecting any client-initiated renegotiations. mod_proxy_ajp: Respond with HTTP_BAD_REQUEST when the body is not sent when request headers indicate a request body is incoming; not a case of HTTP_INTERNAL_SERVER_ERROR. mod_isapi: Do not unload an isapi .dll module until the request processing is completed, avoiding orphaned callback pointers. [This is the most serious flaw, but does not affect Linux systems]

According to its banner, the version of Apache 2.2 installed on the remote host is older than 2.2.15.  Such versions are potentially affected by multiple vulnerabilities : 

  - A TLS renegotiation prefix attack is possible. (CVE-2009-3555)

  - The 'mod_proxy_ajp' module returns the wrong status code if it encounters an error which causes the back-end server to be put into an error state. (CVE-2010-0408)

  - The 'mod_isapi' module attempts to unload the 'ISAPI.DLL' when it encounters various error states which could leave call-backs in an undefined state. (CVE-2010-0425)

  - A flaw in the core sub-request process code can lead to sensitive information from a request being handled by the wrong thread if a multi-threaded environment is used. (CVE-2010-0434)

ID	Name	Product	Family	Severity
104270	SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)	Nessus	SuSE Local Security Checks	critical
69301	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities	Nessus	Web Servers	critical
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
50069	Apache 2.0.x < 2.0.64 Multiple Vulnerabilities	Nessus	Web Servers	high
45004	Apache 2.2.x < 2.2.15 Multiple Vulnerabilities	Nessus	Web Servers	critical
45007	Slackware 12.0 / 12.1 / 12.2 / 13.0 / current : httpd (SSA:2010-067-01)	Nessus	Slackware Local Security Checks	critical
5356	Apache < 2.2.15 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical

Detections

Analytics

CVE-2010-0425

critical

Tenable Plugins

critical

critical

critical

high

critical

critical

critical