PT-2004-1780 · Apache · Apache+1

Virulent · Published 2004-07-21 · Updated 2017-07-11 · CVE-2004-0700

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache mod ssl versions prior to 2.8.19 Apache versions prior to 1.3.31

Description A format string issue exists in the mod proxy hook functions within the ssl engine log.c file of mod ssl. This could potentially allow remote attackers to execute arbitrary messages by including format string specifiers in certain log messages for HTTPS, which are handled by the ssl log function.

Recommendations For Apache mod ssl versions prior to 2.8.19, update to version 2.8.19 or later. For Apache versions prior to 1.3.31, update to version 1.3.31 or later.

Fix

Related Identifiers

CVE-2004-0700

DSA-532

RHSA-2008:0523

Affected Products

Apache

Apache Mod Ssl

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2004-0700 · Security Note
• http://ubuntu.com/usn/usn-177-1 · Vendor Advisory
• http://debian.org/security/2004/dsa-532 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000857 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-405.html · Vendor Advisory
• https://bugzilla.fedora.us/show_bug.cgi?id=1888 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-408.html · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:075 · Vendor Advisory
• http://virulent.siyahsapka.org · Note
• http://osvdb.org/7929 · Note
• http://kb.cert.org/vuls/id/303448 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16705 · Note
• http://marc.info/?l=apache-modssl&m=109001100906749&w=2 · Note
• http://packetstormsecurity.org/0407-advisories/modsslFormat.txt · Note
• http://marc.info/?l=bugtraq&m=109005001205991&w=2 · Note