skipfish扫出来的漏洞

发布于 2022-09-12 04:08:43 字数 3860 浏览 11 评论 9

本帖最后由 dreamice 于 2010-12-15 22:22 编辑

:emn33: 小生求助，我用skipfish扫个站点，出现了2个高危漏洞。。。按理说skipfish扫描的是web程序漏洞！可是我觉得不像是web程序上的漏洞，更可能是Apache的漏洞。。。因为web程序上面根本没有这个目录！我通过网络查阅了大量的相关资料，都没有找到解决问题的方法！
啥也不说了，看结果吧：
========================================
扫描结果
========================================

=== REQUEST ===

PUT /mailman/create/PUT-sfi9876 HTTP/1.1
Host: XXX.XXX.XXX
Accept-Encoding: gzip
Connection: keep-alive
User-Agent: Mozilla/5.0 SF/1.69b
Range: bytes=0-199999
Referer: http://XXX.XXX.XXX/
Cookie: SQMSESSID=deleted;squirrelmail_language=en_US

=== RESPONSE ===

HTTP/1.1 200 OK
Date: Sun, 12 Dec 2010 03:36:43 GMT
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=us-ascii

<HTML>
<HEAD>
<LINK REL="SHORTCUT ICON" HREF="/icons/mm-icon.png">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<TITLE>Bad URL specification</TITLE>
</HEAD>
<BODY bgcolor="white">
<h3><strong><font color="#ff0000" size="+2">Bad URL specification</font></strong></h3><hr>Return to the <a href="http://XXX.XXX.XXX/mailman/listinfo">general list overview</a><br>Return to the <a href="http://XXX.XXX.XXX/mailman/admin">administrative list overview</a>
<table WIDTH="100%" BORDER="0">
<tr>
<td><img src="/icons/mailman.jpg" alt="Delivered by Mailman" border=0><br>version 2.1.5</td>
<td><img src="/icons/PythonPowered.png" alt="Python Powered" border=0></td>
<td><img src="/icons/gnu-head-tiny.jpg" alt="GNU's Not Unix" border=0></td>
</tr>
</table>

</BODY>
</HTML>

=== END OF DATA ===

=================================
第二个高危漏洞
=================================

=== REQUEST ===

PUT /mailman/private/PUT-sfi9876 HTTP/1.1
Host: xxx.xxx.xxx
Accept-Encoding: gzip
Connection: keep-alive
User-Agent: Mozilla/5.0 SF/1.69b
Range: bytes=0-199999
Referer: http://xxx.xxx.xxx/
Cookie: SQMSESSID=deleted;squirrelmail_language=en_US

=== RESPONSE ===

HTTP/1.1 200 OK
Date: Sun, 12 Dec 2010 04:05:38 GMT
Server: Apache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=us-ascii

<HTML>
<HEAD>
<LINK REL="SHORTCUT ICON" HREF="/icons/mm-icon.png">
<META http-equiv="Content-Type" content="text/html; charset=us-ascii">
<TITLE>Private Archive Error - No such list <em>put-sfi9876</em></TITLE>
</HEAD>
<BODY bgcolor="white">
<h2>No such list <em>put-sfi9876</em></h2>
</BODY>
</HTML>

=== END OF DATA ===

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

長街聽風 2022-09-19 11:52:16

回复 9# dreamice
哈哈哈我已经解决了~我这个Apache是RHEL AS 4.7的RPM包安装的，刚开始我还以为跟mailman有关系，于是把mailman关闭了，扫描下还有这2个漏洞，于是又把sendmail关闭了再扫描下没有这个漏洞了！不过不知道在上面的那个语句中说明的是sendmail有漏洞？

回复收藏 0