CVE-2004-0940

Published: Feb 9, 2005Modified: Apr 16, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.

Affected (21)

Products: Apache: Http Server · Openpkg: Openpkg · Hp: Hp Ux · +3 more

Show all products

Apache: Http Server · Openpkg: Openpkg · Hp: Hp Ux · Slackware: Slackware Linux · Suse: Suse Linux · Trustix: Secure Linux

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 1.3 to 1.3.32
Openpkg Openpkg	Version 2.0
Openpkg Openpkg	Version 2.1
Openpkg Openpkg	Version 2.2

Configuration B

17 vulnerable

Vulnerable Software	Affected Versions
Hp Hp Ux	Version 11.00
Hp Hp Ux	Version 11.11
Hp Hp Ux	Version 11.20
Hp Hp Ux	Version 11.22
Slackware Slackware Linux	Version 10.0
Slackware Slackware Linux	Version 8.0
Slackware Slackware Linux	Version 8.1
Slackware Slackware Linux	Version 9.0
Slackware Slackware Linux	Version 9.1
Slackware Slackware Linux	Version current
Suse Suse Linux	Version 8.0
Suse Suse Linux	Version 8.1
Suse Suse Linux	Version 8.2
Suse Suse Linux	Version 9.0
Suse Suse Linux	Version 9.1
Suse Suse Linux	Version 9.2
Trustix Secure Linux	Version 1.5

Related CWEs

CWE-131

Incorrect Calculation of Buffer Size

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

References (42)

http://marc.info/?l=bugtraq&m=109906660225051&w=2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://secunia.com/advisories/12898/

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/19073

Source: cve@mitre.org

Broken Link

http://securitytracker.com/id?1011783

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1

Source: cve@mitre.org

Broken Link

http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

Source: cve@mitre.org

Third Party Advisory

http://www.apacheweek.com/features/security-13

Source: cve@mitre.org

Product

http://www.debian.org/security/2004/dsa-594

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2004:134

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2004-600.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2005-816.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/11471

Source: cve@mitre.org

Broken LinkExploitPatchThird Party AdvisoryVDB EntryVendor Advisory

http://www.vupen.com/english/advisories/2006/0789

Source: cve@mitre.org

Broken Link

https://exchange.xforce.ibmcloud.com/vulnerabilities/17785

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

https://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: cve@mitre.org

Mailing ListPatch

http://marc.info/?l=bugtraq&m=109906660225051&w=2