PT-2002-1447 · Apache · Apache+1

Published 2002-06-17 · Updated 2025-05-26 · CVE-2002-0392

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache versions 1.3 through 1.3.24 Apache versions 2.0 through 2.0.36

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes the software to use an incorrect size. Malicious requests can have various effects, including an increase in system resources, denial of service attacks, and in some cases, the ability to execute arbitrary remote code.

Recommendations For Apache versions 1.3 through 1.3.24, update to a version outside of this range to resolve the issue. For Apache versions 2.0 through 2.0.36, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to chunk-encoded HTTP requests until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2002-0392

Affected Products

Apache

Apache Http Server

References · 55

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_chunked.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16782 · Exploit
• 🔥 https://exploit-db.com/exploits/21559 · Exploit
• 🔥 https://exploit-db.com/exploits/21560 · Exploit
• http://cert.org/advisories/CA-2002-17.html · Patch
• http://novell.com/linux/security/advisories/2002_22_apache.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-103.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2002-0392 · Vendor Advisory
• http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000083816475 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-0392 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-117.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2002-118.html · Vendor Advisory
• http://debian.org/security/2002/dsa-132 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-150.html · Vendor Advisory