JVN Info.

Id
42199  
Name
JVNDB-2009-003206  
Title
BarnOwl および owl におけるバッファオーバーフローの脆弱性  
Summary
BarnOwl および owl には、バッファオーバーフローの脆弱性が存在します。  
Nvdinfo
CVE-2009-0363  
Cvssv2
7.5  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003206.html  
Published Date
2009-02-17  
Registered Date
2012-06-26  
Last Updated Date
2012-06-26  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
55170 21_tokyu_taishin_20170118.csv 42199 57792 CVE-2012-0053 4.3 Medium 157.205.10.2 tcp 80 Apache HTTP Server httpOnly Cookie Information Disclosure The web server running on the remote host is affected by an information disclosure vulnerability. The version of Apache HTTP Server running on the remote host is affected by an information disclosure vulnerability. Sending a request with HTTP headers long enough to exceed the server limit causes the web server to respond with an HTTP 400. By default, the offending HTTP header and value are displayed on the 400 error page. When used in conjunction with other attacks (e.g., cross-site scripting), this could result in the compromise of httpOnly cookies. Upgrade to Apache version 2.0.65 / 2.2.22 or later. http://fd.the-wildcat.de/apache_e36a9cf46c.php http://httpd.apache.org/security/vulnerabilities_20.html http://httpd.apache.org/security/vulnerabilities_22.html http://svn.apache.org/viewvc?view=revision&revision=1235454 Nessus verified this by sending a request with a long Cookie header : GET / HTTP/1.1 Host: websvr157-205-10-2.alpha-prm.jp Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1 Accept-Language: en Connection: Close Cookie: z9=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) Pragma: no-cache Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */* Which caused the Cookie header to be displayed in the default error page (the response shown below has been truncated) : 400 Bad Request

Bad Request

Your browser sent a request that this server could not understand.
Size of a request header field exceeds server limit.

 Cookie: z9=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...