The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3476 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 3 serves as an update     to Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of service or potentially lead to data leak.
    (CVE-2017-12613)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

    * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP     methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use     this flaw to disclose portions of the server memory, or cause httpd child process to crash.
    (CVE-2017-9798)

    Red Hat would like to thank Hanno Bck for reporting CVE-2017-9798.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2483 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before     using it when processing certain headers related to digest authentication. A remote attacker could     possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash     by sending specially crafted requests to a server. (CVE-2017-9788)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A NULL pointer dereference flaw was found in the mod_http2 module of httpd. A remote attacker could use     this flaw to cause httpd child process to crash via a specially crafted HTTP/2 request. (CVE-2017-7659)

    * A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use     this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a     buffer when sending a malicious Content-Type response header. (CVE-2017-7679)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2478 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before     using it when processing certain headers related to digest authentication. A remote attacker could     possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash     by sending specially crafted requests to a server. (CVE-2017-9788)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - 802.1X
  - apache
  - AppleScript
  - ATS
  - Audio
  - CFString
  - CoreText
  - curl
  - Dictionary Widget
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - ImageIO
  - Kernel
  - libarchive
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - Sandbox
  - StreamingZip
  - tcpdump
  - Wi-Fi

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-1918:04 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible     web server.
    CVE-2017-3167     In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of     the ap_get_basic_auth_pw() by third-party modules outside of the     authentication phase may lead to authentication requirements being     bypassed.
    CVE-2017-3169     In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl     may dereference a NULL pointer when third-party modules call     ap_hook_process_connection() during an HTTP request to an HTTPS port.
    CVE-2017-7679     In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime     can read one byte past the end of a buffer when sending a malicious     Content-Type response header.
    CVE-2017-9788     In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value     placeholder in [Proxy-]Authorization headers of type 'Digest' was not     initialized or reset before or between successive key=value     assignments by mod_auth_digest. Providing an initial key with no '='     assignment could reflect the stale value of uninitialized pool memory     used by the prior request, leading to leakage of potentially     confidential information, and a segfault in other cases resulting in     denial of service.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
105368	RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.23 (RHSA-2017:3476)	Nessus	Red Hat Local Security Checks	12/19/2017	11/5/2024	critical
210279	RHEL 6 / 7 : httpd24-httpd (RHSA-2017:2483)	Nessus	Red Hat Local Security Checks	11/5/2024	11/5/2024	critical
221790	Linux Distros Unpatched Vulnerability : CVE-2017-7679	Nessus	Misc.	3/4/2025	9/2/2025	critical
102535	RHEL 6 : httpd (RHSA-2017:2478)	Nessus	Red Hat Local Security Checks	8/17/2017	11/26/2025	critical
104379	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004)	Nessus	MacOS X Local Security Checks	11/3/2017	11/14/2025	critical
289612	MiracleLinux 4 : httpd-2.2.15-60.5.0.1.AXS4 (AXSA:2017-1918:04)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical