PT-2010-1836 · Apache · Apache Http Server
Published
2010-01-27
·
Updated
2021-06-06
·
CVE-2010-0010
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions prior to 1.3.42
Description
The issue is related to an integer overflow in the ap proxy send fb function in mod proxy, which can cause a denial of service or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow. This is due to an incorrect conversion between numeric types, affecting some 64-bit architecture systems. A malicious HTTP server could use this flaw to trigger a heap buffer overflow in an httpd child process via a carefully crafted response.
Recommendations
For Apache HTTP Server versions prior to 1.3.42, update to version 1.3.42 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod proxy module to minimize the risk of exploitation.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Http Server