Lucene search

K
f5F5F5:K3279
HistoryMar 29, 2013 - 12:00 a.m.

K3279 : Heap-based buffer overflow in mod_proxy - CAN-2004-0492

2013-03-2900:00:00
my.f5.com
19

7.6 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.012 Low

EPSS

Percentile

83.9%

Security Advisory Description

Note: Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F5 security vulnerability response policy.

F5 products and versions that have been evaluated for this Security Advisory

Product Affected Not Affected
BIG-IP LTM None 9.x
10.x
11.x
BIG-IP GTM None 9.x
10.x
11.x
BIG-IP ASM None 9.x
10.x
11.x
BIG-IP Link Controller None 9.x
10.x
11.x
BIG-IP WebAccelerator None 9.x
10.x
11.x
BIG-IP PSM None 9.x
10.x
11.x
BIG-IP WAN Optimization None 10.x
11.x
BIG-IP APM None 10.x
11.x
BIG-IP Edge Gateway None 10.x
11.x
BIG-IP Analytics None 11.x
BIG-IP AFM None 11.x
BIG-IP PEM
None 11.x
FirePass None 5.x
6.x
7.x
Enterprise Manager None 1.x
2.x
3.x
ARX None 2.x
3.x
4.x
5.x
6.x

Vulnerability description and product information

Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code by way of a negative Content-Length HTTP header field, which causes a large amount of data to be copied.

Information about this advisory is available at the following location:

Note: This link takes you to a resource outside of AskF5, and it is possible that the information may be removed without our knowledge.

<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0492&gt;

7.6 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.012 Low

EPSS

Percentile

83.9%