Apache mod_ssl ssl_hook_Access Error Handling DoS

The version of Apache running on the remote host is affected by a denial of service vulnerability due to a flaw in modssl that occurs when it is configured with an SSL vhost with access control and a custom 400 error page. A remote attacker can exploit this, via a non-SSL request to an SSL port, ...

CVE-2005-3357

CVE-2005-3357 affects mod_ssl in Apache 2.0 up to 2.0.55; when using an SSL vhost with access control and a custom 400 error page, a non-SSL request to an SSL port can trigger a NULL pointer dereference, causing a denial of service. Remediation/version is not specified in the provided documents.

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

CVE-2005-3357: Undefined Security Weakness

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

httpd, mod_ssl security update

CentOS Errata and Security Advisory CESA-2006:0159 Updated Apache httpd packages that correct three security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server i...

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

CVE-2005-3357

modssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service application crash via a non-SSL request to an SSL port, which triggers a NULL pointer dereference...

Important: Red Hat Security Advisory: openssl, php, mod_ssl, mod_imap security update for Stronghold

Updated versions of cross-platform Stronghold that fix security issues in modssl, modimap, OpenSSL, and PHP are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. Stronghold 4 contains a number of open source technologies, includin...

Apache Httpd < 2.2.2 : mod_ssl access control DoS

A NULL pointer dereference flaw in modssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This...

Apache Httpd < 2.0.58 : mod_ssl access control DoS

A NULL pointer dereference flaw in modssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This...

Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : apache (SSA:2005-310-04)

New apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix potential security issues: If a request contains both Transfer-Encoding and Content-Length headers, remove the Content-Length, mitigating some HTTP Request Splitting/Spoofing attacks. Added...

mod_ssl off by one

The remote host is using a version of modssl which is older than 2.8.10. This version is vulnerable to an off by one buffer overflow which may allow a user with write access to .htaccess files to execute arbitrary code on the system with permissions of the web server. Note that several Linux...

Apache HTTP Server 'mod_ssl' Off By One Vulnerability

The remote host is using a version of modssl which is older than 2.8.10. This version is vulnerable to an off by one buffer overflow which may allow a user with write access to .htaccess files to execute arbitrary code on the system with permissions of the web server. SPDX-FileCopyrightText: 2002...

Apache Input Header Folding and mod_ssl ssl_io_filter_cleanup DoS Vulnerabilities

The remote host appears to be running a version of Apache 2.x which is older than 2.0.50. There is denial of service in apache httpd 2.0.x by sending a specially crafted HTTP request. It is possible to consume arbitrary amount of memory. On 64 bit systems with more than 4GB virtual memory this ma...

mod_ssl hook functions format string vulnerability

The remote host is using a version vulnerable of modssl which is older than 2.8.19. There is a format string condition in the log functions of the remote module which may allow an attacker to execute arbitrary code on the remote host. Some vendors patched older versions of modssl, so this might b...

Apache HTTP Server 'mod_ssl' Hook Functions Format String Vulnerability

The remote host is using a version vulnerable of modssl which is older than 2.8.19. There is a format string condition in the log functions of the remote module which may allow an attacker to execute arbitrary code on the remote host. SPDX-FileCopyrightText: 2004 David Maciejak Some text...

Apache Httpd < 2.0.55 : Malicious CRL off-by-one

An off-by-one stack overflow was discovered in the modssl CRL verification callback. In order to exploit this issue the Apache server would need to be configured to use a malicious certificate revocation list CRL...

Mandrake Linux Security Advisory : apache2 (MDKSA-2005:129)

Marc Stern reported an off-by-one overflow in the modssl CRL verification callback which can only be exploited if the Apache server is configured to use a malicious certificate revocation list CVE-2005-1268. Watchfire reported a flaw that occured when using the Apache server as a HTTP proxy. A...