HTTP: Vulnerable Apache Version ( 1.3.26 through 1.3.31)

This signature detects Apache server versions 1.3.26 through 1.3.31. These versions contain a remote buffer overflow vulnerability. Attackers can exploit this vulnerability to crash the server process, enabling them to execute arbitrary code or cause a denial of service.

Extended Description

A remote buffer overflow vulnerability exists in Apache mod_proxy. The source of this issue is that a negative user-specified length value may be used in a memory copy operation, allowing for corruption of memory. This may triggered if a remote server returns a negative Content-Length: HTTP header field to be passed through the proxy. Exploitation will likely result in a denial of service, though there is an unconfirmed potential for execution of arbitrary code on some platforms (such as BSD implementations). Versions that have the optional AP_ENABLE_EXCEPTION_HOOK define enabled may also be exploitable on some platforms. This issue affects Apache servers 1.3.26 through 1.3.32 that have mod_proxy enabled and configured. Apache 2.0.x releases are not affected by this issue.

Affected Products

Apache_software_foundation apache

References

BugTraq: 10508

CVE: CVE-2004-0492

URL: http://www.debian.org/security/2004/dsa-525 http://www.guninski.com/modproxy1.html

Short Name

HTTP:STC:VULN:APACHE-1-3-26-31

Severity

Info

Recommended

False

Recommended Action

None

HTTP: Vulnerable Apache Version ( 1.3.26 through 1.3.31)

Extended Description

Affected Products

References

Found a potential security threat?