Apache Chunked Encoding Vulnerability on AIX (RS6000)

From: r00tat_private
Date: Tue Aug 13 2002 - 05:10:15 PDT

  • Next message: Benninghoff, John: "RE: Apache Chunked Encoding Vulnerability on AIX (RS6000)"

    Hi All,
    
    I am currently pen-testing an AIX platform, which utilises Apache and IBM HTTP 
    server in order to communicate with a back-end AS400 enviornment.
    
    I have scanned the remote host with the eeye tool Retina - Apache Chunked 
    scanner V 1,0,3, which reports the host vulnerable.
    
    It would appear the tool attempts to exploit the vulnerability by attempting to 
    send a small request that makes a vulnerable server to become unresponsive.
    
    Would I be right to say that this vulnerability is not exploitable on an RS6000 
    platform, given the current exploits in the wild, and the eeye tool is again 
    producing false positives ????????
    
    Any help is very much appreciated.
    
    Thanks in advance.
    
    
    ./Mark
    
    
    PS: SF Bid number = BID 5033
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/
    



    This archive was generated by hypermail 2b30 : Tue Aug 13 2002 - 10:44:06 PDT