Blog Elements | SecurityOrb.com

Vulnerability

Severity

Host

Location

Actions

Apache Web Server ETag Header Information Disclosure Weakness

4.3 (Medium)

x.x.x.x

80/tcp

SummaryA weakness has been discovered in Apache web servers that are configured to use the FileETag directive.

Vulnerability Detection Result

Information that was gathered:
Inode: 815822
Size: 177

ImpactExploitation of this issue may provide an attacker with information that may be used to launch further attacks against a target network.

SolutionOpenBSD has released a patch that addresses this issue. Inode numbers returned from the server are now encoded using a private hash to avoid the release of sensitive information.Novell has released TID10090670 to advise users to apply the available workaround of disabling the directive in the configuration file for Apache releases on NetWare. Please see the attached Technical Information Document for further details.

Vulnerability Detection MethodDue to the way in which Apache generates ETag response headers, it may be possible for an attacker to obtain sensitive information regarding server files. Specifically, ETag header fields returned to a client contain the file’s inode number.Details: Apache Web Server ETag Header Information Disclosure Weakness (OID: 1.3.6.1.4.1.25623.1.0.103122)

Version used: $Revision: 1218 $

References

CVE:	CVE-2003-1418
BID:	6939
CERT:	DFN-CERT-2015-0495
Other:	https://www.securityfocus.com/bid/6939
	http://httpd.apache.org/docs/mod/core.html#fileetag
	http://www.openbsd.org/errata32.html
	http://support.novell.com/docs/Tids/Solutions/10090670.html

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

The SecurityOrb Show – An Interview with Jayson E. Street, InfoSec Ranger at Pwnie Express, Author and Speaker – 6/3/2015

Apache Web Server ETag Header Information Disclosure Weakness

The SecurityOrb Show – An Interview with Jayson E. Street, InfoSec Ranger at Pwnie Express, Author and Speaker – 6/3/2015

Apache Web Server ETag Header Information Disclosure Weakness

Full Sized Blog Element (Big Preview Pic)

The SecurityOrb Show – An Interview with Jayson E. Street, InfoSec Ranger at Pwnie Express, Author and Speaker – 6/3/2015

Apache Web Server ETag Header Information Disclosure Weakness

INTERESTING LINKS

Latest News

Business Hours