The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in the Enterprise Manager Base Platform component.

An update for httpd is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es) :

* A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798)

* A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd, causing comments in the 'Allow' and 'Deny' configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
(CVE-2017-12171)

Red Hat would like to thank Hanno BAPck for reporting CVE-2017-9798 and KAWAHARA Masashi for reporting CVE-2017-12171.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2405:01 advisory.

    * A use-after-free flaw was found in the way httpd handled invalid and     previously unregistered HTTP methods specified in the Limit directive used in an     .htaccess file. A remote attacker could possibly use this flaw to disclose     portions of the server memory, or cause httpd child process to crash.
    (CVE-2017-9798)     Asianux would like to thank Hanno Bck for reporting this issue.
    Bug Fix(es):
      * The httpd package installation script tried to create both the apache user     and group in a single useradd command. Consequently, when the apache group     had already been created on the system, the command failed, and the apache     user was not created. To fix this bug, the apache group is now created by a     separate command, and the apache user is correctly created during httpd     installation even when the apache group exists. (BZ#1486843)
      * When installing the httpd24 Software Collection using the yum command, if     the apache group already existed on the system with GID other than 48, the     apache user was not created. This update fixes the bug. (BZ#1487164)
      * With this update, it is possible to run the mod_rewrite external mapping     program as a non-root user. (BZ#1486832)
      * On a Asianux Server 4 system, when the httpd service was stopped twice in a     row by running the service httpd stop command, a misleading message was     returned: Stopping httpd: [FAILED]. This bug has been fixed. (BZ#1418395)
      * When the service httpd24-httpd graceful command was used on Asianux Server     7 while the httpd24-httpd service was not running, the daemon was started     without being tracked by systemd. As a consequence, the daemon ran in an     incorrect SELinux domain. This bug has been fixed, and the httpd daemon runs in     the correct SELinux domain in the described scenario. (BZ#1440858)     Enhancement(s):
      * With this update, the mod_ssl module supports the ALPN protocol on Asianux     Server 7.4 and later versions. (BZ#1327548)     For further details, see the Asianux Software Collections 3.0 Release Notes     linked from the References section.
    CVE-2017-9798     Apache httpd allows remote attackers to read secret data from process     memory if the Limit directive can be set in a user's .htaccess file, or     if httpd.conf has certain misconfigurations, aka Optionsbleed. This     affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27.
    The attacker sends an unauthenticated OPTIONS HTTP request when     attempting to read secret data. This is a use-after-free issue and thus     secret data is not always sent, and the specific data depends on many     factors including configuration. Exploitation with .htaccess can be     blocked with a patch to the ap_limit_section function in server/core.c.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for VirtualBox to version 5.1.36 fixes multiple issues :

Security issues fixed :

  - CVE-2018-0739: Unauthorized remote attacker may have     caused a hang or frequently repeatable crash (complete     DOS)

  - CVE-2018-2830: Attacker with host login may have     compromised Virtualbox or further system services after     interaction with a third user

  - CVE-2018-2831: Attacker with host login may have     compromised VirtualBox or further system services,     allowing read access to some data

  - CVE-2018-2835: Attacker with host login may have gained     control over VirtualBox and possibly further system     services after interacting with a third user

  - CVE-2018-2836: Attacker with host login may have gained     control over VirtualBox and possibly further system     services after interacting with a third user

  - CVE-2018-2837: Attacker with host login may have gained     control over VirtualBox and possibly further system     services after interacting with a third user

  - CVE-2018-2842: Attacker with host login may have gained     control over VirtualBox and possibly further system     services after interacting with a third user

  - CVE-2018-2843: Attacker with host login may have gained     control over VirtualBox and possibly further system     services after interacting with a third user 

  - CVE-2018-2844: Attacker with host login may have gained     control over VirtualBox and possibly further system     services after interacting with a third user 

  - CVE-2018-2845: Attacker with host login may have caused     a hang or frequently repeatable crash (complete DOS),     and perform unauthorized read and write operation to     some VirtualBox accessible data

  - CVE-2018-2860: Privileged attacker may have gained     control over VirtualBox and possibly further system     services

http://www.oracle.com/technetwork/security-advisory/cpuapr2018verbose- 3678108.html http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067 .html#AppendixOVIR

This update also contains all upstream fixes and improvements in the stable 5.1.36 release.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3476 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 3 serves as an update     to Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are     documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * An out-of-bounds array dereference was found in apr_time_exp_get(). An attacker could abuse an     unvalidated usage of this function to cause a denial of service or potentially lead to data leak.
    (CVE-2017-12613)

    * It was discovered that the use of httpd's ap_get_basic_auth_pw() API function outside of the     authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw     to bypass required authentication if the API was used incorrectly by one of the modules used by httpd.
    (CVE-2017-3167)

    * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use     this flaw to cause an httpd child process to crash if another module used by httpd called a certain API     function during the processing of an HTTPS request. (CVE-2017-3169)

    * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's     MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679)

    * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP     methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use     this flaw to disclose portions of the server memory, or cause httpd child process to crash.
    (CVE-2017-9798)

    Red Hat would like to thank Hanno Bck for reporting CVE-2017-9798.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for apache2 fixes the following issues :

  - Allow disabling SNI on proxy connections using 'SetEnv     proxy-disable-sni 1' in the configuration files.
    (bsc#1052830)

  - Allow ECDH again in mod_ssl, it had been incorrectly     disabled with the 2.2.34 update. (bsc#1064561) Following     security issue has been fixed :

  - CVE-2017-9798: A use-after-free in the OPTIONS command     could be used by attackers to disclose memory of the     apache server process, when htaccess uses incorrect     Limit statement. (bsc#1058058) Additionally, references     to the following security issues, fixed by the previous     version-update of apache2 to Apache HTTPD 2.2.34 have     been added :

  - CVE-2017-7668: The HTTP strict parsing introduced a bug     in token list parsing, which allowed ap_find_token() to     search past the end of its input string. By maliciously     crafting a sequence of request headers, an attacker may     have be able to cause a segmentation fault, or to force     ap_find_token() to return an incorrect value.
    (bsc#1045061)

  - CVE-2017-3169: mod_ssl may have de-referenced a NULL     pointer when third-party modules call     ap_hook_process_connection() during an HTTP request to     an HTTPS port allowing for DoS. (bsc#1045062)

  - CVE-2017-3167: Use of the ap_get_basic_auth_pw() by     third-party modules outside of the authentication phase     may have lead to authentication requirements being     bypassed. (bsc#1045065)

  - CVE-2017-7679: mod_mime could have read one byte past     the end of a buffer when sending a malicious     Content-Type response header. (bsc#1045060)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
111152	Oracle Enterprise Manager Cloud Control Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	7/20/2018	4/11/2022	critical
119234	Virtuozzo 6 : httpd / httpd-devel / httpd-manual / httpd-tools / etc (VZLSA-2017-2972)	Nessus	Virtuozzo Local Security Checks	11/27/2018	5/26/2022	high
288994	MiracleLinux 4 : httpd24-1.1-18.AXS4, httpd24-httpd-2.4.27-8.AXS4 (AXSA:2017-2405:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	high
109294	openSUSE Security Update : virtualbox (openSUSE-2018-389) (Optionsbleed)	Nessus	SuSE Local Security Checks	4/24/2018	10/25/2024	high
105368	RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.23 (RHSA-2017:3476)	Nessus	Red Hat Local Security Checks	12/19/2017	11/5/2024	critical
104270	SUSE SLES11 Security Update : apache2 (SUSE-SU-2017:2907-1) (Optionsbleed)	Nessus	SuSE Local Security Checks	10/31/2017	11/17/2025	critical

Detections

Analytics

Plugins Search

critical

high

high

high

critical

critical