Yo quiero la ip
De momento buscando la versión de httpd que paso el compañero encontré que tiene varias vulns interesantes. La mayoría son de DOS pero hay una de overflow que si no es una versión de httpd falsa para confundir se podría aprovechar (si usa ese mod)
https://httpd.apache.org/security/vulnerabilities_24.html moderate: mod_status buffer overflow CVE-2014-0226
A race condition was found in mod_status. An attacker able to access a public server status page on a server using a threaded MPM could send a carefully crafted request which could lead to a heap buffer overflow. Note that it is not a default or recommended configuration to have a public accessible server status page.
Acknowledgements: This issue was reported by Marek Kroemeke, AKAT-1 and 22733db72ab3ed94b5f8a1ffcde850251fe6f466 via HP ZDI
Reported to security team: 30th May 2014
Issue public: 14th July 2014
Update Released: 14th July 2014
Affects: 2.4.9, 2.4.8, 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, 2.4.1
Dejo esto que en caso de que este habilitado quizás sirve...
http://www.exploit-db.com/exploits/34133/
Mostrar Mensajes
