HTTP: Apache HTTP Server mod_isapi Dangling Pointer Remote Code Execution

This signature detects attempts to exploit a known code execution vulnerability in Apache HTTP server. It is due an error in the mod_isapi when processing maliciously crafted HTTP requests. An attacker can exploit this to cause a memory corruption by sending a crafted HTTP request to a target server. A successful attack can lead to the execution of arbitrary code on the target server. The behavior of the target server depends entirely on the intention of the malicious code. The code executes within the security context of the affected service, which is SYSTEM. In an unsuccessful attack, the target server can terminate abnormally, resulting in a denial-of-service condition.

Extended Description

Apache is prone to a memory-corruption vulnerability. Attackers can leverage this vulnerability to execute arbitrary code with SYSTEM privileges; failed attacks may result in denial-of-service conditions. Apache versions prior to 2.2.15 are affected.

Affected Products

Blue_coat_systems director,Sun opensolaris

References

BugTraq: 38494

CVE: CVE-2010-0425

Short Name

HTTP:APACHE:MOD-ISAPI-RCE

Severity

Critical

Recommended

False

Recommended Action

Drop

HTTP: Apache HTTP Server mod_isapi Dangling Pointer Remote Code Execution

Extended Description

Affected Products

References

Found a potential security threat?