[SA12434] Apache 2 mod_ssl Connection Abort Denial of Service

TITLE: Apache 2 modssl Connection Abort Denial of Service SECUNIA ADVISORY ID: SA12434 VERIFY ADVISORY: http://secunia.com/advisories/12434/ CRITICAL: Less critical IMPACT: DoS WHERE: From remote SOFTWARE: Apache 2.0.x http://secunia.com/product/73/ DESCRIPTION: A vulnerability has been reported ...

Apache mod_ssl DoS

Child process goes to infinite loop on SSL connection abort...

Important: Red Hat Security Advisory: httpd security update

Updated httpd packages that include a security fix for modssl and various enhancements are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. An input filter bug in modssl was discovered in Apache httpd version 2.0.50 and earlier. A...

CVE-2002-1157

CVE-2002-1157 describes a Cross-site scripting vulnerability in the Apache mod_ssl module (versions 2.8.9 and earlier). The issue occurs when UseCanonicalName is Off and wildcard DNS is enabled, allowing a remote attacker to cause the server name in an HTTPS response to be used in a self-referenc...

CVE-2004-0113

Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service memory consumption via plain HTTP requests to the SSL port of an SSL-enabled server...

CVE-2002-1157

Cross-site scripting vulnerability in the modssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a...

CVE-2002-1157: Undefined Security Weakness

Cross-site scripting vulnerability in the modssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a...

CVE-2004-0113: Undefined Security Weakness

Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service memory consumption via plain HTTP requests to the SSL port of an SSL-enabled server...

RHEL 3 : httpd (RHSA-2004:349)

Updated httpd packages that include a security fix for modssl and various enhancements are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. An input filter bug in modssl was discovered in Apache httpd version 2.0.50 and earlier. A...

GLSA-200407-18 : mod_ssl: Format string vulnerability

The remote host is affected by the vulnerability described in GLSA-200407-18 modssl: Format string vulnerability A bug in sslengineext.c makes modssl vulnerable to a ssllog related format string vulnerability in the modproxy hook functions. Impact : Given the right server configuration, an attack...

Apache HTTP Server < 2.0.49 mod_ssl Plain HTTP Request DoS

Binary data 1205.prm...

Apache-SSL < 1.47 mod_ssl i2d_SSL_SESSION Function Overflow

Binary data 1496.prm...

Apache mod_ssl Session Cache Code Overflow

Binary data 1513.prm...

mod_ssl < 2.8.10 Wildcard DNS Server Name XSS

Binary data 1529.prm...

Apache mod_ssl < 2.8.10 Off-by-one Overflow

Binary data 1512.prm...

Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:020)

Ed Moyle discovered a buffer overflow in modssl's session caching mechanisms that use shared memory and dbm. This could potentially be triggered by sending a very long client certificate to the server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:048)

Frank Denis discovered an off-by-one error in modssl dealing with the handling of older configuration directorives the rewritecommand hook. A malicious user could use a specially crafted .htaccess file to execute arbitrary commands as the apache user or execute a DoS against the apache child...

Mandrake Linux Security Advisory : mod_ssl (MDKSA-2002:072)

A cross-site scripting vulnerability was discovered in modssl by Joe Orton. This only affects servers using a combination of wildcard DNS and 'UseCanonicalName off' which is not the default in Mandrake Linux. With this setting turned off, Apache will attempt to use the hostname:port that the clie...

Mandrake Linux Security Advisory : mod_ssl (MDKSA-2004:054)

A stack-based buffer overflow exists in the sslutiluuencodebinary function in sslenginekernel.c in modssl for Apache 1.3.x. When modssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN. The provided...

Mandrake Linux Security Advisory : apache2 (MDKSA-2004:043)

A memory leak in modssl in the Apache HTTP Server prior to version 2.0.49 allows a remote denial of service attack against an SSL-enabled server. The updated packages provide a patched modssl to correct these problems. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...