PT-2004-1830 · Apache · Apache+1

Published 2004-07-07 · Updated 2022-09-23 · CVE-2004-0751

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache 2.x versions 2.0.44 through 2.0.50

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault or crash of an httpd child process. This occurs when the server is configured to allow proxying to a remote SSL server and a malicious remote SSL server sends a carefully crafted response header. The issue is not believed to allow execution of arbitrary code and will only result in a denial of service where a threaded process model is in use.

Recommendations For Apache 2.x versions 2.0.44 through 2.0.50, consider disabling the mod ssl module or restricting its use to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0751

RHSA-2004:463

Affected Products

Apache

Apache Http Server

References · 30

• 🔥 https://exploit-db.com/exploits/24590 · Exploit
• http://gentoo.org/security/en/glsa/glsa-200409-21.xml · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0751 · Vendor Advisory
• http://issues.apache.org/bugzilla/show_bug.cgi?id=30134 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0751 · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0751 · Security Note
• http://redhat.com/support/errata/RHSA-2004-463.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0751 · Vendor Advisory
• http://novell.com/linux/security/advisories/2004_30_apache2.html · Vendor Advisory
• http://trustix.org/errata/2004/0047 · Vendor Advisory
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3E · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-09/0096.html · Note
• https://httpd.apache.org/security/vulnerabilities_20.html#CVE-2004-0751 · Note