Apache Httpd < 2.0.53 : Memory consumption DoS

An issue was discovered where the field length limit was not enforced for certain malicious requests. This could allow a remote attacker who is able to send large amounts of data to a server the ability to cause Apache children to consume proportional amounts of memory, leading to a denial of...

GLSA-200409-21 : Apache 2, mod_dav: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200409-21 Apache 2, moddav: Multiple vulnerabilities A potential infinite loop has been found in the input filter of modssl CAN-2004-0748 as well as a possible segmentation fault in the charbufferread function if reverse proxying ...

RHEL 3 : httpd (RHSA-2004:463)

Updated httpd packages that include fixes for security issues are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Four issues have been discovered affecting releases of the Apache HTTP 2.0 Server, up to and including version 2.0.50 :...

apache -- ap_resolve_env buffer overflow

SITIC discovered a vulnerability in Apache 2's handling of environmental variable settings in the httpd configuration files the main httpd.conf' and .htaccess' files. According to a SITIC advisory: The buffer overflow occurs when expanding $ENVVAR constructs in .htaccess or httpd.conf files. The...

Apache Httpd < 2.0.51 : WebDAV remote crash

An issue was discovered in the moddav module which could be triggered for a location where WebDAV authoring access has been configured. A malicious remote client which is authorized to use the LOCK method could force an httpd child process to crash by sending a particular sequence of LOCK request...

CVE-2002-1549

Buffer overflow in Light HTTPd lhttpd 0.1 allows remote attackers to execute arbitrary code via a long HTTP GET request...

CVE-2004-0096

CVE-2004-0096 targets mod_python and is associated with a denial-of-service affecting Apache via a crafted query string. OpenVAS entries include CVE linkage (CVE-2004-0096) and note a 5.0 base score (AV:N/AC:L/Au:N/C:N/I:N/A:P); related CAN-2003-0973 is cited. The vulnerability is discussed in mu...

Apache Httpd < 2.0.51 : IPv6 URI parsing heap overflow

Testing using the Codenomicon HTTP Test Tool performed by the Apache Software Foundation security group and Red Hat uncovered an input validation issue in the IPv6 URI parsing routines in the apr-util library. If a remote attacker sent a request including a carefully crafted URI, an httpd child...

DEBIAN-CVE-2004-0493

The apgetmimeheaderscore function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service memory exhaustion, and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters...

Apache Httpd < 2.0.51 : Environment variable expansion flaw

A buffer overflow was found in the expansion of environment variables during configuration file parsing. This issue could allow a local user to gain the privileges of a httpd child if a server can be forced to parse a carefully crafted .htaccess file written by a local user...

Fedora Core 1 : httpd-2.0.49-1.1 (2004-117)

This update includes the latest stable release of Apache httpd 2.0, including a security fix for a memory leak in modssl which can be triggered remotely CVE-2004-0113, and a fix for escaping of error log output CVE-2003-0020. This update also includes an enhanced version of the modcgi module whic...

Fedora Core 2 : httpd-2.0.50-2.1 (2004-204)

This update includes the latest stable release of Apache httpd 2.0, including security fixes for a remotely triggerable memory leak CVE-2004-0493, and a buffer overflow in modssl which can be triggered only by a trusted client certificate with a long subject DN field CVE-2004-0488. Note that...

Fedora Core 1 : httpd-2.0.50-1.0 (2004-203)

This update includes the latest stable release of Apache httpd 2.0, including security fixes for a remotely triggerable memory leak CVE-2004-0493, and a buffer overflow in modssl which can be triggered only by a trusted client certificate with a long subject DN field CVE-2004-0488. Note that...

Apache HTTPd Arbitrary Long HTTP Headers DoS

Exploit for unknown platform in category dos / poc ============================================ Apache HTTPd Arbitrary Long HTTP Headers DoS ============================================ /usr/bin/perl exploit for apache apgetmimeheaderscore vuln adv is here: http://www.guninski.com/httpd1.html...

Apache Httpd < 2.0.51 : SSL connection infinite loop

An issue was discovered in the modssl module in Apache 2.0. A remote attacker who forces an SSL connection to be aborted in a particular state may cause an Apache child process to enter an infinite loop, consuming CPU resources...

Apache Httpd < 2.0.51 : Malicious SSL proxy can cause crash

An issue was discovered in the modssl module in Apache 2.0.44-2.0.50 which could be triggered if the server is configured to allow proxying to a remote SSL server. A malicious remote SSL server could force an httpd child process to crash by sending a carefully crafted response header. This issue ...

RHEL 2.1 : mod_ssl (RHSA-2002:136)

Updated modssl packages are now available for Red Hat Advanced Server. These updates incorporate a fix for an incorrect bounds check in versions of modssl up to and including version 2.8.9. The modssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL a...

CVE-2004-0493

The apgetmimeheaderscore function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service memory exhaustion, and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters...

[Full-Disclosure] [RHSA-2004:182-01] Updated httpd packages fix mod_ssl security issue

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated httpd packages fix modssl security issue Advisory ID: RHSA-2004:182-01 Issue date: 2004-04-30 Updated on: 2004-04-30 Product: Red Hat...

Apache Httpd < 2.0.45 : Line feed memory leak DoS

Apache 2.0 versions before Apache 2.0.45 had a significant Denial of Service vulnerability. Remote attackers could cause a denial of service memory consumption via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed...