CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
71.6%
The remote host is running a version of Apache web server prior to 1.3.31. It is, therefore, affected by an access control bypass vulnerability due to a failure, on big-endian 64-bit platforms, to properly match ‘allow’ or ‘deny’ rules that contain an IP address but lack a corresponding netmask.
Nessus has determined the vulnerability exists only by looking at the Server header returned by the web server running on the target. If the target is not a big-endian 64-bit platform, consider this a false positive.
#
# This script was written by George A. Theall, <[email protected]>.
#
# See the Nessus Scripts License for details.
#
include("compat.inc");
if (description)
{
script_id(14177);
script_version("1.31");
script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");
script_cve_id("CVE-2003-0993");
script_bugtraq_id(9829);
script_xref(name:"GLSA", value:"GLSA 200405-22");
script_xref(name:"MDKSA", value:"MDKSA-2004:046");
script_xref(name:"SSA", value:"SSA:2004-133-01");
script_xref(name:"Secunia", value:"11088");
script_xref(name:"Secunia", value:"11681");
script_xref(name:"Secunia", value:"11719");
script_xref(name:"Secunia", value:"12246");
script_name(english:"Apache < 1.3.31 mod_access IP Address Netmask Rule Bypass");
script_summary(english:"Checks for Apache version");
script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by an access control bypass
vulnerability.");
script_set_attribute(attribute:"description", value:
"The remote host is running a version of Apache web server prior to
1.3.31. It is, therefore, affected by an access control bypass
vulnerability due to a failure, on big-endian 64-bit platforms, to
properly match 'allow' or 'deny' rules that contain an IP address but
lack a corresponding netmask.
Nessus has determined the vulnerability exists only by looking at the
Server header returned by the web server running on the target. If the
target is not a big-endian 64-bit platform, consider this a false
positive.");
script_set_attribute(attribute:"see_also", value:"http://www.apacheweek.com/features/security-13");
script_set_attribute(attribute:"see_also", value:"http://marc.info/?l=apache-cvs&m=107869603013722" );
script_set_attribute(attribute:"see_also", value:"https://bz.apache.org/bugzilla/show_bug.cgi?id=23850" );
script_set_attribute(attribute:"solution", value:"Upgrade to Apache web server version 1.3.31 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2004/03/08");
script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/31");
script_set_attribute(attribute:"potential_vulnerability", value:"true");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:http_server");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2004-2020 George A. Theall");
script_family(english:"Web Servers");
script_dependencie("apache_http_version.nasl", "ssh_get_info.nasl");
script_require_keys("installed_sw/Apache", "Settings/ParanoidReport");
script_require_ports("Services/www", 80);
exit(0);
}
include("audit.inc");
include("backport.inc");
include("global_settings.inc");
include("http_func.inc");
if (report_paranoia < 2) audit(AUDIT_PARANOID);
uname = get_kb_item("Host/uname");
if ( uname )
{
if ( pgrep(pattern:"i.86", string:uname) ) exit(0);
}
host = get_host_name();
port = get_http_port(default:80, embedded:TRUE);
if (!get_port_state(port)) exit(0);
# Check the web server's banner for the version.
banner = get_http_banner(port:port);
if (!banner) exit(0);
banner = get_backport_banner(banner:banner);
sig = strstr(banner, "Server:");
if (!sig) exit(0);
if(preg(pattern:"^Server:.*Apache(-AdvancedExtranetServer)?/1\.([0-2]\.[0-9]|3\.([0-9][^0-9]|[0-2][0-9]))", string:sig)) {
security_hole(port);
}
Vendor | Product | Version | CPE |
---|---|---|---|
apache | http_server | cpe:/a:apache:http_server |