I have installed Apache/2.2.4 (Unix) mod_ssl/2.2.4 OpenSSL/0.9.8a.
Scanned this server with nessus scanner  and it reports a hole
security:

"https (443/tcp)"
"The remote web server seems to be vulnerable to a format string
attack on the method name. An attacker might use this flaw to make it
crash or even execute arbitrary code on this host."

"Solution: upgrade your software or contact your vendor and inform him
of this vulnerability"

but i have installed the most recient version of apache. Any idea?
thanks

[ Post a follow-up to this message ]

nachodelavega@gmail.com wrote:
> I have installed Apache/2.2.4 (Unix) mod_ssl/2.2.4 OpenSSL/0.9.8a.
> Scanned this server with nessus scanner  and it reports a hole
> security:
>
> "https (443/tcp)"
> "The remote web server seems to be vulnerable to a format string
> attack on the method name. An attacker might use this flaw to make it
> crash or even execute arbitrary code on this host."
>
> "Solution: upgrade your software or contact your vendor and inform him
> of this vulnerability"
>
> but i have installed the most recient version of apache. Any idea?
> thanks

Hi,

one possibility is that nessus regfers to the version of openssl. the
current is 0.9.8e

hth,
Roy

[ Post a follow-up to this message ]