Re: Reg. Apache version check

[Srivatsan]

Hi, Just curious to know what will happen if I applied a Patch released by Redhat for Apache ? For e.g.,, the following link contains a patch for CAN-2003-0542, CAN-2003-0789 http://rhn.redhat.com/errata/RHSA-2003-320.html The rpm file is: httpd-2.0.40-11.9.i386.rpm. Will the Banner from the Server be 2.0.40-11.9 or just 2.0.40 ? If it is just 2.0.40, then the plugin will succeed, even after applying the patch, resulting in false positive. I tried to install this patch on my RedHat Linux 8.0 but installation failed because of glibc dependency. Had anybody tried ? Thanks, Srivatsan. P George Theall wrote: On Fri, May 07, 2004 at 08:38:40PM +0530, Srivatsan wrote: As per "CAN-2003-0083" : "Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not filter terminal escape sequences from its access logs ..........." http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0083 But in the file: nessus-plugins/scripts/apache_2_0_42.nasl, the script ... i.e., it checks for Apache versions older than 2.0.42, whereas the CVE website describes the vulnerable Apache Version as older than 2.0.46 I think you have a point, although I also think the fix is not to simply modify the regex pattern. As it stands, apache_2_0_42.nasl (plugin #11408) currently checks for not only for CAN-2003-0083 but also CAN-2002-1156. But per cvs.mitre.org, the former affects apache 1.3 before 1.3.25 as well as apache 2.0 before version 2.0.46 while the latter affects only 2.0.42. Thus, the current version check can result in false positives for CAN-2002-1156 on one hand and false negatives for CAN-2003-0083 on the other hand. I think the best approach is to use separate plugins to check for each of these vulnerabilities. Renaud, thoughts? George _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus

_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus