NewStart CGSL CORE 5.05 / MAIN 5.05 : httpd Multiple Vulnerabilities (NS-SA-2021-0159)

high Nessus Plugin ID 154565
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote NewStart CGSL host is affected by multiple vulnerabilities.

Description

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has httpd packages installed that are affected by multiple vulnerabilities:

- In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename. (CVE-2017-15715)

- In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a Session header. This comes from the HTTP_SESSION variable name used by mod_session to forward its data to CGIs, since the prefix HTTP_ is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. (CVE-2018-1283)

- A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
(CVE-2018-1303)

- In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. (CVE-2019-10098)

- In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. (CVE-2020-1927)

- In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. (CVE-2020-1934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade the vulnerable CGSL httpd packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

See Also

http://security.gd-linux.com/notice/NS-SA-2021-0159

http://security.gd-linux.com/info/CVE-2017-15715

http://security.gd-linux.com/info/CVE-2018-1283

http://security.gd-linux.com/info/CVE-2018-1303

http://security.gd-linux.com/info/CVE-2019-10098

http://security.gd-linux.com/info/CVE-2020-1927

http://security.gd-linux.com/info/CVE-2020-1934

Plugin Details

Severity: High

ID: 154565

File Name: newstart_cgsl_NS-SA-2021-0159_httpd.nasl

Version: 1.3

Type: local

Published: 10/27/2021

Updated: 10/29/2021

Dependencies: ssh_get_info.nasl

Risk Information

CVSS Score Source: CVE-2017-15715

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:2.3:a:zte:cgsl_core:httpd:*:*:*:*:*:*:*, cpe:2.3:o:zte:cgsl_main:5:*:*:*:*:*:*:*, cpe:2.3:o:zte:cgsl_core:5:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:httpd:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:httpd-devel:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:httpd-manual:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:httpd-tools:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:mod_ssl:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:httpd-devel:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:httpd-manual:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:httpd-tools:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:mod_ldap:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:mod_proxy_html:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:mod_session:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_core:mod_ssl:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:mod_ldap:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:mod_proxy_html:*:*:*:*:*:*:*, p-cpe:2.3:a:zte:cgsl_main:mod_session:*:*:*:*:*:*:*

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2021

Vulnerability Publication Date: 3/21/2018

Reference Information

CVE: CVE-2019-10098, CVE-2017-15715, CVE-2018-1283, CVE-2018-1303, CVE-2020-1934, CVE-2020-1927

IAVA: 2018-A-0089-S