CVE-2004-0492

Published: Aug 6, 2004Modified: Apr 16, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.

Affected (17)

Products: Apache: Http Server · Hp: Virtualvault, Webproxy, Vvos · Ibm: Http Server · +2 more

Show all products

Apache: Http Server · Hp: Virtualvault, Webproxy, Vvos · Ibm: Http Server · Sgi: Propack · Openbsd: Openbsd

1 product

3 products

1 product

1 product

1 product

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Version 1.3.26
Apache Http Server	Version 1.3.27
Apache Http Server	Version 1.3.28
Apache Http Server	Version 1.3.29
Apache Http Server	Version 1.3.31
Hp Virtualvault	Version 11.0.4
Hp Webproxy	Version 2.0
Hp Webproxy	Version 2.1
Ibm Http Server	Version 1.3.26.1
Ibm Http Server	Version 1.3.26.2
Ibm Http Server	Version 1.3.26
Ibm Http Server	Version 1.3.28
Sgi Propack	Version 2.4

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Hp Vvos	Version 11.04
Openbsd Openbsd	All versions
Openbsd Openbsd	Version 3.4
Openbsd Openbsd	Version 3.5

References (48)

ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc (unsafe URL)

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=108711172710140&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=130497311408250&w=2

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2004-245.html

Source: cve@mitre.org

PatchVendor Advisory

http://seclists.org/lists/fulldisclosure/2004/Jun/0296.html

Source: cve@mitre.org

http://secunia.com/advisories/11841

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101555-1

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1

Source: cve@mitre.org

http://www.debian.org/security/2004/dsa-525

Source: cve@mitre.org

PatchVendor Advisory

http://www.guninski.com/modproxy1.html

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/541310

Source: cve@mitre.org

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2004:065

Source: cve@mitre.org

https://bugzilla.fedora.us/show_bug.cgi?id=1737

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/16387

Source: cve@mitre.org

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100112

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4863

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc (unsafe URL)

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=108711172710140&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=130497311408250&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2004-245.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://seclists.org/lists/fulldisclosure/2004/Jun/0296.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/11841

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101555-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-26-101841-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57628-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2004/dsa-525

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.guninski.com/modproxy1.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/541310

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2004:065

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.fedora.us/show_bug.cgi?id=1737

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/16387

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100112

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4863

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.