PT-2005-4158 · Apache+2 · Apache+3

Published 2005-12-12 · Updated 2024-06-15 · CVE-2005-3357

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache 2.0 versions 2.0 up to 2.0.55

Description The issue is related to a NULL pointer dereference flaw in mod ssl, affecting server configurations with an SSL virtual host that has access control and a custom 400 error document. A remote attacker can send a carefully crafted request to trigger this issue, leading to a crash, which results in a denial of service, particularly when using the worker MPM.

Recommendations For Apache 2.0 versions 2.0 up to 2.0.55, consider disabling the custom 400 error document for SSL virtual hosts with access control as a temporary workaround until a patch is available. Restrict access to the SSL port to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2005-3357

HPSBUX02172

OPENSUSE-SU-2024:10623-1

RHSA-2006:0159

RHSA-2006_0159

Affected Products

Apache

Apache Http Server

Hp-Ux

Red Hat

References · 108

• http://vupen.com/english/advisories/2006/3995 · Vendor Advisory
• http://securityfocus.com/archive/1/425399/100/0/threaded · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1 · Vendor Advisory
• http://secunia.com/advisories/22669 · Vendor Advisory
• http://trustix.org/errata/2005/0074 · Vendor Advisory
• http://securityfocus.com/archive/1/445206/100/0/threaded · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2006-0159.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-3357 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10623-1 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4868 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3357 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4300 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html · Vendor Advisory
• http://secunia.com/advisories/22992 · Vendor Advisory