On Fri, May 07, 2004 at 08:38:40PM +0530, Srivatsan wrote: > As per "CAN-2003-0083" : > "Apache 1.3 before 1.3.25 and Apache 2.0 before version 2.0.46 does not > filter terminal escape sequences from its access logs ..........." > http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0083 > > But in the file: nessus-plugins/scripts/apache_2_0_42.nasl, the script ... > i.e., it checks for Apache versions older than 2.0.42, whereas the CVE > website describes the vulnerable Apache Version as older than 2.0.46
I think you have a point, although I also think the fix is not to simply modify the regex pattern. As it stands, apache_2_0_42.nasl (plugin #11408) currently checks for not only for CAN-2003-0083 but also CAN-2002-1156. But per cvs.mitre.org, the former affects apache 1.3 before 1.3.25 as well as apache 2.0 before version 2.0.46 while the latter affects only 2.0.42. Thus, the current version check can result in false positives for CAN-2002-1156 on one hand and false negatives for CAN-2003-0083 on the other hand. I think the best approach is to use separate plugins to check for each of these vulnerabilities. Renaud, thoughts? George -- [EMAIL PROTECTED]
pgp00000.pgp
Description: PGP signature
_______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
