I am running RHEL 6. Why does the scan show the vulnerabilities on the port that directory administration server is using?
Hello, as you mentioned, all of the CVEs are quite old (older than RHEL-6). For instance, the last one CVE-2009-1956 was fixed in apr-util-1.2.7-7.el5_3.1. As long as you use RHEL-6, the CVEs you listed are all fixed. Also, please note that the CVEs are all httpd related, not 389-ds.
CVE:
CVE-2008-0005
CVE-2007-6388
CVE-2007-6422
CVE-2007-6420
CVE-2007-5000
CVE-2007-6421
CVE-2008-1678
CVE-2007-1862
CVE-2007-3847
CVE-2007-3304
CVE-2006-5752
CVE-2007-1863
CVE-2009-1891
CVE-2009-1955
CVE-2009-1191
CVE-2009-0023
CVE-2009-1956
CVE-2009-1195
CVE-2009-1890
John Trump wrote:
I have a system running 389-ds that was scanned using retna. Retna showed vulnerabilities which are fairly old. Can anyone confirm that these were fixed. Only thing using port 9830 is the admin-serv. Below are the rpm versions I have installed and the CVE's retna supposidly detected.
389-adminutil-1.1.19-1.el6.x86_64389-ds-console-doc-1.2.6-1.el6.noarch389-admin-1.1.35-1.el6.x86_64389-admin-console-1.1.8-5.fc19.noarch389-console-1.1.7-1.el6.noarch389-ds-1.2.2-1.el6.noarch389-ds-base-libs-1.2.11.25-1.el6.x86_64389-ds-base-1.2.11.25-1.el6.x86_64389-dsgw-1.1.11-1.el6.x86_64389-ds-console-1.2.6-1.el6.noarch389-admin-console-doc-1.1.8-5.fc19.noarch
Audit ID: 6310 Vul ID: N/A
Risk Level: MediumSev Code: Category IIPCI Level: Medium (Fail) - CVSS ScoreCVSS Score: 5 [AV:N/AC:L/Au:N/C:N/I:N/A:P]BugTraq ID 27234,26838,27236,27237CVE: CVE-2008-0005,CVE-2007-6388,CVE-2007-6422,CVE-2007-6420,CVE-2007-5000,CVE-2007-6421,CVE-2008-1678CCE: N/AExploit: NoIAV: N/ASTIG:Context: TCP:9830Result: SuccessTested Value: BR T WB Server:(Apache(\([[]^)]*\))?/((2\.((2(\.[[]0-7])?)|(0(\.([[]1-5]?[[]0-9]|6[[]0-2]))?)|(1(\..*)?)))|(1\.((3(\.([[]1-3]?[[]0-9]|40))?)|([[]0-2](\..*)?)))|(0+\..*))($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$))Found Value: Server: Apache/2.2##Content-Length: 301##Connection:close##Content-Type: text/html;charset[=]iso-8859-1####<!DOCTYPE HTML PUBLIC"-//IETF//DTD HTML 2.0//EN">#<html><head>#<title>404 NotFound</title>#</head><body>#<h1>Not Found</h1>(truncated...)
Audit ID: 6059 Vul ID: N/ARisk Level: MediumSev Code: Category IIPCI Level: Medium (Fail) - CVSS ScoreCVSS Score: 5 [AV:N/AC:L/Au:N/C:P/I:N/A:N]BugTraq ID 24215,24645,25489,24649,24553CVE: CVE-2007-1862,CVE-2007-3847,CVE-2007-3304,CVE-2006-5752,CVE-2007-1863CCE: N/AExploit: NoIAV: N/ASTIG:Context: TCP:9830Result: SuccessTested Value: RR T WB(Apache(\([[]^)]*\))?/(2\.2(\.[[]0-5])?)($|[[]^0-9.]([[]^(]*\([[]^R][[]^)]*\))*[[]^()]*$))Found Value: Apache/2.2
Audit ID: 9820 Vul ID: N/ARisk Level: MediumSev Code: Category IIPCI Level: High (Fail) - CVSS ScoreCVSS Score: 7.8 [AV:N/AC:L/Au:N/C:N/I:N/A:C]BugTraq ID 35565,35253,35623,35251,34663,35221,35115CVE: CVE-2009-1891,CVE-2009-1955,CVE-2009-1191,CVE-2009-0023,CVE-2009-1956,CVE-2009-1195,CVE-2009-1890CCE: N/AExploit: YesIAV: N/ASTIG:Context: TCP:9830Result: SuccessTested Value: APACHE(-ADVANCEDEXTRANETSERVER)?/2\.2(\.(1[[]01]|[[]0-9])(\.[[]0-9]+)*)?($|[[]^0-9.])Found Value: APACHE/2.2
-- 389 users mailing list 389-users@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users
--
389 users mailing list
389-users@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users