PT-2004-1610 · Gentoo+4 · Gentoo Linux+7

Publicado 2004-06-30 · Atualizado 2021-06-06 · CVE-2004-0493

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache httpd version 2.0.49 IBM HTTP Server (affected versions not specified) Avaya Converged Communications Server (affected versions not specified) Avaya S8300 (affected versions not specified) Avaya S8500 (affected versions not specified) Avaya S8700 (affected versions not specified) Gentoo Linux (affected versions not specified) Trustix Secure Linux (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service due to memory exhaustion, and possibly an integer signedness error leading to a heap-based buffer overflow on 64-bit systems. This can be achieved via long header lines with large numbers of space or tab characters in HTTP headers. A memory leak in parsing of HTTP headers can also be triggered remotely, allowing a denial of service attack due to excessive memory consumption.

Recommendations For Apache httpd version 2.0.49, consider updating to a newer version to mitigate the risk. For IBM HTTP Server, Avaya Converged Communications Server, Avaya S8300, Avaya S8500, Avaya S8700, Gentoo Linux, and Trustix Secure Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2004-0493

RHSA-2004:342

Produtos afetados

Apache Http Server

Avaya Converged Communications Server

Avaya S8300

Avaya S8500

Avaya S8700

Gentoo Linux

Ibm Http Server

Trustix Secure Linux

Referências · 32

• 🔥 https://exploit-db.com/exploits/360 · Exploit
• 🔥 https://exploit-db.com/exploits/371 · Exploit
• 🔥 http://securityfocus.com/bid/10619 · Exploit
• http://trustix.org/errata/2004/0039 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0493 · Nota de Segurança
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://security-tracker.debian.org/tracker/CVE-2004-0493 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10605 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2004:064 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=109181600614477&w=2 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E · Nota
• http://marc.info/?l=bugtraq&m=108853066800184&w=2 · Nota
• https://osv.dev/vulnerability/CVE-2004-0493 · Aviso do Fabricante