CVE-2002-0842: Undefined Security Weakness

Format string vulnerability in certain third party modifications to moddav for logging bad gateway messages e.g. Oracle9i Application Server 9.0.2 allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string...

RHEL 3 : httpd (RHSA-2004:084)

Updated httpd packages are now available that fix a denial of service vulnerability in modssl and include various other bug fixes. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. A memory leak in modssl in the Apache HTTP Server prior to version...

Important: Red Hat Security Advisory: httpd security update

Updated httpd packages are now available that fix a denial of service vulnerability in modssl and include various other bug fixes. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. A memory leak in modssl in the Apache HTTP Server prior to version...

DEBIAN-CVE-2003-0245

Vulnerability in the aprpsprintf function in the Apache Portable Runtime APR library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via long strings, as demonstrated using XML objects to moddav, and possibly other...

Apache 2.x APR Exploit Code

I had planned to write this tool in C for the sake of using native functionality like crypt3 to support digest authentication. I'd also planned to support intermediate proxies, but a determined user can implement this via various tunneling applications with minimal complications, and I don't need...

Apache Portable Runtime Denial of Service and Arbitrary Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDEFENSE Security Advisory 05.30.03: http://www.idefense.com/advisory/05.30.03.txt Apache Portable Runtime Denial of Service and Arbitrary Code Execution Vulnerability May 30, 2003 I. BACKGROUND The Apache Software Foundation's HTTP Server Project is ...

CVE-2002-0842

Format string vulnerability in certain third party modifications to moddav for logging bad gateway messages e.g. Oracle9i Application Server 9.0.2 allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string...

Re: CSSA-2003-007.0 Advisory withdrawn.

-----BEGIN PGP SIGNED MESSAGE----- Just to clarify this a bit further, the moddav module for Apache is not vulnerable to the format string vulnerability as outlined in the original advisory from SCO, CAN-2002-0842 moddav contains code that logs various errors and uses aplogrerror to do so. In...

Apache mod_dav format string bug

aplogrerror format string bug...

Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav module format string vulnerability

To: [email protected] [email protected] [email protected] [email protected] SCO Security Advisory Subject: Linux: Apache moddav module format string vulnerability Advisory number: CSSA-2003-007.0 Issue date: 2003 February 17 Cross reference: 1...

Some implementations of mod_dav contain a format string vulnerability in "ap_log_rerror()" function

Overview A vulnerability in some implementations of moddav may permit a remote attacker to gain unauthorized access to a web server running moddav. Description moddav is a module designed to provide DAV capabilities for a web server. A format string vulnerability in some implementations may permi...

Apache mod_dav module vulnerable to DoS

Overview A denial-of-service vulnerability exists in Apache moddav. Description moddav is an Apache module. This module enables Apache web servers to provide users the ability to edit and manage files on a remote web server using the HTTP protocol. A vulnerability in moddav may allow an attacker ...

DEBIAN-CVE-2002-1593

moddav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service CPU consumption in a preforked multi-processing module...

CVE-2002-1593

moddav in Apache before 2.0.42 does not properly handle versioning hooks, which may allow remote attackers to kill a child process via a null dereference and cause a denial of service CPU consumption in a preforked multi-processing module...

Apache Httpd < 2.0.42 : mod_dav crash

A flaw was found in handling of versioning hooks in moddav. An attacker could send a carefully crafted request in such a way to cause the child process handling the connection to crash. This issue will only result in a denial of service where a threaded process model is in use...