PT-2004-1968 · Apache+1 · Apache Web Server+2

Published 2004-11-01 · Updated 2021-06-06 · CVE-2004-0942

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Apache webserver versions 2.0.52 and earlier

Description: The issue allows remote attackers to cause a denial of service by consuming CPU or memory resources. This can be achieved through an HTTP GET request with a MIME header containing multiple lines with a large number of space characters, or by sending large amounts of data to the server, which can cause Apache children to consume proportional amounts of memory.

Recommendations: For Apache webserver versions 2.0.52 and earlier, consider restricting the size of HTTP requests and enforcing field length limits to prevent large amounts of data from being sent to the server. As a temporary workaround, consider configuring the server to limit the amount of memory available to each Apache child process to minimize the risk of denial of service.

Exploit

Fix

Related Identifiers

CVE-2004-0942

HPSBUX01123

RHSA-2004:562

Affected Products

Apache Http Server

Apache Web Server

Hp-Ux

References · 48

• 🔥 https://exploit-db.com/exploits/855 · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0885 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0942 · Security Note
• http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0942 · Vendor Advisory
• http://trustix.org/errata/2004/0061 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:135 · Vendor Advisory
• http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01123 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0942 · Security Note
• http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110384374213596&w=2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0942 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-562.html · Vendor Advisory