Detections
Analytics
FreeBSD : mod_jk -- information disclosure (d9405748-1342-11dc-a35c-001485ab073e)
medium Nessus Plugin ID 25427
Synopsis
The remote FreeBSD host is missing one or more security-related updates.Description
Kazu Nambo reports :URL decoding the the Apache webserver prior to decoding in the Tomcat server could pypass access control rules and give access to pages on a different AJP by sending a crafted URL.
Solution
Update the affected packages.See Also
http://tomcat.apache.org/connectors-doc/news/20070301.html#20070518.1
Plugin Details
Severity: Medium
ID: 25427
File Name: freebsd_pkg_d9405748134211dca35c001485ab073e.nasl
Version: 1.17
Type: local
Family: FreeBSD Local Security Checks
Published: 6/5/2007
Updated: 1/6/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:mod_jk, p-cpe:/a:freebsd:freebsd:mod_jk-ap2, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 6/5/2007
Vulnerability Publication Date: 5/18/2007
Reference Information
CVE: CVE-2007-1860