Mailing List Archive: get_backport_banner() false negative

In several cases I have seen a "vanilla" Apache HTTPD instance getting
mis-classified by get_backport_banner() from backport.inc. This leads
to the instance being incorrectly deemed by Nessus as fully patched
while it in fact suffers from a number of vulnerabilities.
The problematic section of backport.inc v1.51 is:

# OpenBSD (to be verified)
backported_versions[i++] = "Apache/1.3.29 (Unix)";
real_versions[j++] = "Apache/1.3.99 (OpenBSD)";

This code has been added fairly recently; v1.49 does not have it.

In the latest case it mistook a plain Apache on AIX:

Server: Apache/1.3.29 (Unix) PHP/4.3.4

Cheers,
nnposter
_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers

This has been fixed, thanks.

On Sep 23, 2008, at 5:23 AM, nnposter@users.sourceforge.net wrote:

> In several cases I have seen a "vanilla" Apache HTTPD instance getting
> mis-classified by get_backport_banner() from backport.inc. This leads
> to the instance being incorrectly deemed by Nessus as fully patched
> while it in fact suffers from a number of vulnerabilities.
> The problematic section of backport.inc v1.51 is:
>
> # OpenBSD (to be verified)
> backported_versions[i++] = "Apache/1.3.29 (Unix)";
> real_versions[j++] = "Apache/1.3.99 (OpenBSD)";
>
> This code has been added fairly recently; v1.49 does not have it.
>
> In the latest case it mistook a plain Apache on AIX:
>
> Server: Apache/1.3.29 (Unix) PHP/4.3.4
>
>
> Cheers,
> nnposter
> _______________________________________________
> Plugins-writers mailing list
> Plugins-writers@list.nessus.org
> http://mail.nessus.org/mailman/listinfo/plugins-writers
>

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers