On Fri, May 07, 2004 at 08:38:40PM +0530, Srivatsan wrote:

> As per "CAN-2003-0083" :
> "Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not 
> filter terminal escape sequences from its access logs ..........."
> http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0083
> 
> But in the file: nessus-plugins/scripts/apache_2_0_42.nasl, the script 
...
> i.e., it checks for Apache versions older than 2.0.42, whereas the CVE 
> website describes the vulnerable Apache Version as older than  2.0.46

I think you have a point, although I also think the fix is not to simply
modify the regex pattern.

As it stands, apache_2_0_42.nasl (plugin #11408) currently checks for
not only for CAN-2003-0083 but also CAN-2002-1156.  But per
cvs.mitre.org, the former affects apache 1.3 before 1.3.25 as well as
apache 2.0 before version 2.0.46 while the latter affects only 2.0.42. 
Thus, the current version check can result in false positives for
CAN-2002-1156 on one hand and false negatives for CAN-2003-0083 on the
other hand. 

I think the best approach is to use separate plugins to check for each
of these vulnerabilities.  Renaud, thoughts?


George
-- 
[EMAIL PROTECTED]

Attachment: pgp00000.pgp
Description: PGP signature

_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus

Reply via email to