PT-2003-2510 · Apache · Apache+1

Published 2003-06-10 · Updated 2021-06-06 · CVE-2004-0492

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache versions 1.3.25 through 1.3.31

Description A heap-based buffer overflow issue exists in the mod proxy module of Apache, which can be triggered by a negative Content-Length HTTP header field. This allows remote attackers to cause a denial of service, potentially leading to process crashes. On some BSD platforms, this issue may also lead to remote arbitrary code execution. An attacker would need to get an Apache installation configured as a proxy to connect to a malicious site to exploit this issue.

Recommendations For Apache versions 1.3.25 through 1.3.31, consider disabling the mod proxy module until a patch is available to prevent potential exploitation. Restrict access to the proxy functionality to minimize the risk of denial of service or arbitrary code execution.

Fix

Related Identifiers

CVE-2004-0492

DSA-525

Affected Products

Apache

Apache Http Server

References · 27

• ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:065 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2004-245.html · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1 · Vendor Advisory
• http://debian.org/security/2004/dsa-525 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=130497311408250&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0492 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-101555-1 · Vendor Advisory
• https://bugzilla.fedora.us/show_bug.cgi?id=1737 · Vendor Advisory
• https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E · Note
• https://httpd.apache.org/security/vulnerabilities_13.html#CVE-2004-0492 · Note
• https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0492 · Note
• http://guninski.com/modproxy1.html · Note