Unsupported Web Server Detection

Tenable plugin 34460 is not a CVE and does not prove a working exploit on its own. It remotely fingerprints a web service, largely from the HTTP Server response header and related web fingerprinting dependencies, then flags versions or product families Tenable considers obsolete or unsupported. The affected range is therefore product-specific and generic at the same time: anything the plugin maps to an end-of-support branch, including examples shown in the NASL logic such as legacy IIS (7.0/7.5), Oracle Application Server 9.x/10.1.2.x, and older legacy server families; Apache handling was later split into separate end-of-life plugins.

Tenable's Critical 10.0 label is a policy score for unsupported software, not a measurement of exploitability for a concrete flaw. In real operations, that overstates urgency because the attack chain still requires a second step: an attacker must find a real, applicable vulnerability for the exact server build, and banner-based version checks can be wrong in environments using distro backports, reverse proxies, or sanitized headers. That said, the finding is still worth fixing because an internet-facing EOL web server is a standing invitation for opportunistic follow-on exploitation.

Why this verdict

• Not a CVE: the plugin identifies unsupported software condition, not a named exploitable flaw.
• Attack path requires a second win: an attacker still needs reachability, accurate fingerprinting, and a real product-specific exploit for the exact build and modules.
• Reachability narrows reality fast: internal-only web servers are already post-initial-access, and internet-facing ones may still be hidden behind CDNs, reverse proxies, or WAFs.
• Scanner logic is coarse: the plugin relies heavily on remote version/banner inference, which is exactly where distro backports and proxy headers create noise.
• Why not ignore it entirely: if the origin really is EOL and exposed, the future bug pipeline is effectively permanent because the vendor has stopped shipping fixes.

Why not higher?

There is no confirmed exploit path, no KEV evidence for the finding itself, and no proof that the origin service—not just a fronting proxy—actually runs an unsupported branch. A Critical label only makes sense once you can tie the host to a concrete, reachable CVE or active exploitation signal.

Why not lower?

This is still a public-attack-surface hygiene problem, especially for externally reachable web tiers. Unsupported web servers tend to accumulate unfixed exposure over time, and once a real bug appears there may be no vendor patch path at all.

1. Validate the banner finding — Confirm whether the flagged Server header belongs to the origin server or a proxy/CDN and whether the package is truly unsupported versus distro-backported. For a LOW verdict there is no SLA; treat this as backlog hygiene and close false positives before escalating engineering effort.
2. Inventory the real web stack — Map each hit to the actual product, package source, and support contract state, including extended support where applicable. For LOW, there is no SLA; fold this into normal asset hygiene and lifecycle management rather than incident-style response.
3. Reduce origin exposure — Keep legacy origins behind reverse proxies, CDNs, or internal-only network paths where possible so unsupported software is not directly internet-reachable. For LOW, there is no SLA; do this as part of standard surface-reduction work.
4. Harden the web tier account — Limit service-account privileges, strip local admin/root, rotate embedded credentials, and isolate backend access so a future web-server exploit does not become instant domain-wide blast radius. For LOW, there is no SLA; schedule it with normal platform hardening.
5. Plan lifecycle replacement — Move confirmed EOL products onto supported branches or supported vendor channels, including distro-supported packages if that is your standard. For LOW, there is no SLA; keep it in backlog hygiene unless a concrete CVE or exploitation signal appears.

Run this from an auditor workstation or scanner host with network access to the target URL. Invoke it as python3 verify_34460.py https://app.example.com or python3 verify_34460.py --server-header "Microsoft-IIS/7.5"; no privileges are required.

#!/usr/bin/env python3
# verify_34460.py
# Purpose: sanity-check Tenable plugin 34460 by looking at a remote HTTP Server header
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/ERROR

import argparse
import re
import sys
import ssl
import urllib.request

LEGACY_PATTERNS = [
    (r'^Microsoft-IIS/7\.0$', 'IIS 7.0 is EOL with its underlying OS lifecycle'),
    (r'^Microsoft-IIS/7\.5$', 'IIS 7.5 is EOL with its underlying OS lifecycle'),
    (r'^Oracle-Application-Server-9i/9\.0\.2', 'Oracle Application Server 9.0.2.x is legacy/EOL'),
    (r'^Oracle-Application-Server-9i/9\.0\.3', 'Oracle Application Server 9.0.3.x is legacy/EOL'),
    (r'^Oracle-Application-Server-10g/9\.0\.4', 'Oracle Application Server 9.0.4.x is legacy/EOL'),
    (r'^Oracle-Application-Server-10g/10\.1\.2', 'Oracle Application Server 10.1.2.x is legacy/EOL'),
    (r'^(CERN httpd |CERN/)', 'CERN httpd is obsolete'),
    (r'(Apache|Mod_)JServ/', 'Apache JServ is obsolete'),
    (r'^NCSA/[1-9]', 'NCSA HTTPd is obsolete'),
    (r'^SAMBAR', 'Sambar Server is obsolete'),
    (r'Sami HTTP Server', 'Sami HTTP Server is obsolete'),
    (r'^Savant/', 'Savant Web Server is obsolete'),
    (r'iPlanet|Netscape|Sun-Java-System-Web-Server/|Sun Java System Web Server/|Sun-ONE-Web-Server/|SunONE WebServer ', 'Legacy Netscape/iPlanet/Sun ONE family is obsolete'),
]

SUPPORTED_HINTS = [
    (r'^Microsoft-IIS/(8\.0|8\.5|10\.0)$', 'Header advertises a supported-or-newer IIS family than the ones explicitly flagged in plugin 34460'),
    (r'^nginx/', 'NGINX header seen; plugin 34460 is generic and cannot prove unsupported status from this alone'),
    (r'^Apache/', 'Apache header seen; Apache support status is handled by separate Tenable SEoL plugins, not reliably by 34460 alone'),
]

def fetch_server_header(url: str, timeout: int = 10):
    ctx = ssl.create_default_context()
    req = urllib.request.Request(url, method='HEAD', headers={'User-Agent': 'verify_34460/1.0'})
    try:
        with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:
            return resp.headers.get('Server')
    except Exception:
        try:
            req = urllib.request.Request(url, method='GET', headers={'User-Agent': 'verify_34460/1.0'})
            with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:
                return resp.headers.get('Server')
        except Exception:
            return None


def assess(header: str):
    if not header:
        return ('UNKNOWN', 'No Server header obtained; banner-based validation is inconclusive')

    header = header.strip()

    for pattern, reason in LEGACY_PATTERNS:
        if re.search(pattern, header, re.IGNORECASE):
            return ('VULNERABLE', f'{reason}; observed header: {header}')

    for pattern, reason in SUPPORTED_HINTS:
        if re.search(pattern, header, re.IGNORECASE):
            return ('PATCHED', f'{reason}; observed header: {header}')

    return ('UNKNOWN', f'Header observed but not in this plugin-specific legacy map: {header}')


def main():
    parser = argparse.ArgumentParser(description='Sanity-check Tenable plugin 34460 using a remote Server header or a supplied header string.')
    parser.add_argument('url', nargs='?', help='Target URL, e.g. https://app.example.com')
    parser.add_argument('--server-header', dest='server_header', help='Server header string to test directly, e.g. "Microsoft-IIS/7.5"')
    args = parser.parse_args()

    if not args.url and not args.server_header:
        print('UNKNOWN - provide a URL or --server-header')
        sys.exit(3)

    header = args.server_header
    if not header:
        header = fetch_server_header(args.url)

    status, detail = assess(header)
    print(f'{status} - {detail}')

    if status == 'PATCHED':
        sys.exit(0)
    elif status == 'VULNERABLE':
        sys.exit(1)
    else:
        sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable plugin 34460
2. Tenable plugin 34460 dependencies
3. Tenable plugin attributes
4. Mirrored NASL logic for obsolete_httpd.nasl
5. Apache HTTP Server 2.2 vulnerabilities / EOL note
6. NGINX Open Source branch and support model
7. Ubuntu Security Team FAQ
8. Red Hat backporting and scanner caveats