PT-2003-1424 · Apache · Mod Ssl+2

Published 2003-07-09 · Updated 2021-06-06 · CVE-2003-0192

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apache versions prior to 2.0.47 Apache 1.3 with certain versions of mod ssl

Description: The issue arises from improper handling of certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one. This could cause the use of a weak ciphersuite. A bug in the optional renegotiation code in mod ssl can cause cipher suite restrictions to be ignored when optional renegotiation is used along with verification of client certificates and a change to the cipher suite over the renegotiation.

Recommendations: For Apache versions prior to 2.0.47, update to version 2.0.47 or later to resolve the issue. For Apache 1.3 with certain versions of mod ssl, consider disabling the optional renegotiation feature by removing the SSLOptions +OptRenegotiate directive until a patched version of mod ssl is available.

Fix

Related Identifiers

CVE-2003-0192

Affected Products

Apache

Apache Http Server

Mod Ssl

References · 25

• http://redhat.com/support/errata/RHSA-2003-240.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0192 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0192 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0192 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-244.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0192 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-243.html · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2004.6/SCOSA-2004.6.txt · Vendor Advisory
• https://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• http://marc.info/?l=bugtraq&m=105776593602600&w=2 · Note