PT-2004-1874 · Apache · Apache+1

Published 2004-09-12 · Updated 2022-09-23 · CVE-2004-0809

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache versions 2.0.50 and earlier

Description The issue is related to the mod dav module, which allows remote attackers to cause a denial of service by crashing a child process. This can be achieved by sending a specific sequence of LOCK requests to a location with WebDAV authoring access. The issue does not allow execution of arbitrary code and only results in a denial of service when a threaded process model is in use.

Recommendations For Apache versions 2.0.50 and earlier, consider disabling the mod dav module as a temporary workaround to prevent the denial of service. Restrict access to locations with WebDAV authoring access to minimize the risk of exploitation. Avoid using the LOCK method in affected locations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2004-0809

DSA-558-1

RHSA-2004:463

Affected Products

Apache

Apache Http Server

References · 26

• 🔥 http://trustix.org/errata/2004/0047 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2004-0809 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200409-21.xml · Vendor Advisory
• http://mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:096 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-463.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0809 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0809 · Vendor Advisory
• http://debian.org/security/2004/dsa-558 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0809 · Vendor Advisory
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17366 · Note
• https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9588 · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note