PT-2004-1923 · Apache+1 · Apache Mod Ssl+2

Published 2004-10-01 · Updated 2021-06-06 · CVE-2004-0885

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Apache mod ssl versions 2.0.35 through 2.0.52

Description: The issue allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration when the "SSLCipherSuite" directive is used in directory or location context.

Recommendations: For Apache mod ssl versions 2.0.35 through 2.0.52, consider restricting the use of the SSLCipherSuite directive to the server configuration level to prevent remote clients from bypassing intended restrictions. As a temporary workaround, review and restrict the allowed cipher suites in the virtual host configuration to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0885

HPSBUX01123

RHSA-2004:562

RHSA-2008:0261

RHSA-2008:0523

RHSA-2008:0524

Affected Products

Apache Http Server

Apache Mod Ssl

Hp-Ux

References · 51

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0885 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0885 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0885 · Security Note
• https://osv.dev/vulnerability/CVE-2004-0885 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-816.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-600.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-562.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0885 · Vendor Advisory
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01123 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0942 · Security Note
• http://ubuntu.com/usn/usn-177-1 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0261.html · Vendor Advisory