PT-2004-1610 · Gentoo+4 · Gentoo Linux+7

Published 2004-06-30 · Updated 2021-06-06 · CVE-2004-0493

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache httpd version 2.0.49 IBM HTTP Server (affected versions not specified) Avaya Converged Communications Server (affected versions not specified) Avaya S8300 (affected versions not specified) Avaya S8500 (affected versions not specified) Avaya S8700 (affected versions not specified) Gentoo Linux (affected versions not specified) Trustix Secure Linux (affected versions not specified)

Description The issue allows remote attackers to cause a denial of service due to memory exhaustion, and possibly an integer signedness error leading to a heap-based buffer overflow on 64-bit systems. This can be achieved via long header lines with large numbers of space or tab characters in HTTP headers. A memory leak in parsing of HTTP headers can also be triggered remotely, allowing a denial of service attack due to excessive memory consumption.

Recommendations For Apache httpd version 2.0.49, consider updating to a newer version to mitigate the risk. For IBM HTTP Server, Avaya Converged Communications Server, Avaya S8300, Avaya S8500, Avaya S8700, Gentoo Linux, and Trustix Secure Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0493

RHSA-2004:342

Affected Products

Apache Http Server

Avaya Converged Communications Server

Avaya S8300

Avaya S8500

Avaya S8700

Gentoo Linux

Ibm Http Server

Trustix Secure Linux

References · 32

• 🔥 https://exploit-db.com/exploits/360 · Exploit
• 🔥 https://exploit-db.com/exploits/371 · Exploit
• 🔥 http://securityfocus.com/bid/10619 · Exploit
• http://trustix.org/errata/2004/0039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0493 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2004-0493 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:064 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=109181600614477&w=2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0493 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0493 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-342.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200407-03.xml · Vendor Advisory
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E · Note