HTTP: Negative Content-Length Overflow
This signature detects a negative Content-Length value. Apache Web servers 1.3.26 through 1.3.32 shipped with mod_proxy, which contains a buffer overflow vulnerability. Attackers can exploit this vulnerability by sending a negative Content-Length value to the server, enabling them to run malicious code or crash the server.
Extended Description
A remote buffer overflow vulnerability exists in Apache mod_proxy. The source of this issue is that a negative user-specified length value may be used in a memory copy operation, allowing for corruption of memory. This may triggered if a remote server returns a negative Content-Length: HTTP header field to be passed through the proxy. Exploitation will likely result in a denial of service, though there is an unconfirmed potential for execution of arbitrary code on some platforms (such as BSD implementations). Versions that have the optional AP_ENABLE_EXCEPTION_HOOK define enabled may also be exploitable on some platforms. This issue affects Apache servers 1.3.26 through 1.3.32 that have mod_proxy enabled and configured. Apache 2.0.x releases are not affected by this issue.
Affected Products
Apache_software_foundation apache
Short Name
HTTP:MISC:NEG-CTN-LENGTH
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
CVE-2004-0095 CVE-2004-0492 CVE-2004-0493 CVE-2006-2162 CVE-2006-3655 CVE-2011-3491 CVE-2012-0271 Content-Length Negative Overflow bid:10508 bid:49605 bid:55551
Release Date
01/25/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Unknown
Vendors
Apache_software_foundation
Red_hat
Openbsd
Ibm
Trustix
Sun
Hp
Sgi
Slackware
CVSS Score
10.0
5.1
6.4
5.0