PT-2003-1704 · Apache · Apache+1

Published 2003-10-27 · Updated 2021-06-06 · CVE-2003-0542

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache versions prior to 1.3.29

Description: The issue is related to multiple stack-based buffer overflows in the mod alias and mod rewrite modules. This can be triggered by using a regular expression with more than 9 captures, potentially leading to a denial of service (crash) or the execution of arbitrary code. An attacker would need to create a carefully crafted configuration file, such as .htaccess or httpd.conf, to exploit this issue.

Recommendations: For Apache versions prior to 1.3.29, update to version 1.3.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod alias and mod rewrite modules until a patch is applied. Avoid using regular expressions with more than 9 captures in configuration files for these modules until the issue is resolved.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2003-0542

RHSA-2004:015

Affected Products

Apache

Apache Http Server

References · 59

• https://osv.dev/vulnerability/CVE-2003-0542 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-360.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2004/Jan/msg00000.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0542 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0542 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=130497311408250&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0542 · Security Note
• http://redhat.com/support/errata/RHSA-2003-405.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-816.html · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:103 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-320.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-015.html · Vendor Advisory
• http://securityfocus.com/bid/8911 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101444-1 · Vendor Advisory