PT-2004-1967 · Apache · Apache +1

Published

2004-10-21

·

Updated

2024-02-02

·

CVE-2004-0940

Report an issue
CVSS v2.0
6.9
VectorAV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions:

Apache versions 1.3.x through 1.3.32

Description:

The issue is related to a buffer overflow in the get tag function in mod include, which allows local users who can create SSI documents to execute arbitrary code as the apache user. This can be achieved via SSI (XSSI) documents that trigger a length calculation error, potentially allowing a local user to gain the privileges of an httpd child.

Recommendations:

For Apache versions 1.3.x through 1.3.32, consider disabling the mod include module until a patch is available to prevent exploitation of the buffer overflow vulnerability. Restrict access to creating SSI documents to minimize the risk of arbitrary code execution.

Exploit

Fix

Weakness Enumeration

CWE-131

Related Identifiers

CVE-2004-0940
DSA-594-1

Affected Products

Apache
Apache Http Server