PT-2004-1858 · Apache · Apr-Util+2

Published 2004-09-15 · Updated 2022-09-23 · CVE-2004-0786

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache versions prior to 2.0.51

Description The issue is related to the IPv6 URI parsing routines in the apr-util library, which can be exploited by remote attackers to cause a denial of service, specifically a child process crash, by sending a request with a carefully crafted URI. In some cases, on certain BSD systems, this flaw may potentially lead to remote code execution.

Recommendations For Apache versions prior to 2.0.51, update to version 2.0.51 or later to resolve the issue. As a temporary workaround, consider restricting access to the IPv6 URI parsing routines in the apr-util library until a patch is available.

Fix

Related Identifiers

CVE-2004-0786

RHSA-2004:463

Affected Products

Apache

Apache Http Server

Apr-Util

References · 26

• http://gentoo.org/security/en/glsa/glsa-200409-21.xml · Vendor Advisory
• http://novell.com/linux/security/advisories/2004_32_apache2.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0786 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0786 · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:096 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0786 · Security Note
• http://trustix.org/errata/2004/0047 · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11380 · Note
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0786 · Note
• http://secunia.com/advisories/12540 · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note