CVE-2010-0010

Published: Feb 2, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.

Affected (46)

Products: Apache: Http Server

1 product

Configuration A

46 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Up to 1.3.41
Apache Http Server	Version 0.8.11
Apache Http Server	Version 0.8.14
Apache Http Server	Version 1.0.3
Apache Http Server	Version 1.0.5
Apache Http Server	Version 1.0
Apache Http Server	Version 1.1
Apache Http Server	Version 1.2.4
Apache Http Server	Version 1.2.5
Apache Http Server	Version 1.2.6
Apache Http Server	Version 1.2
Apache Http Server	Version 1.3.0
Apache Http Server	Version 1.3.10
Apache Http Server	Version 1.3.11
Apache Http Server	Version 1.3.12
Apache Http Server	Version 1.3.13
Apache Http Server	Version 1.3.14
Apache Http Server	Version 1.3.15
Apache Http Server	Version 1.3.17
Apache Http Server	Version 1.3.18
Apache Http Server	Version 1.3.19
Apache Http Server	Version 1.3.1
Apache Http Server	Version 1.3.20
Apache Http Server	Version 1.3.22
Apache Http Server	Version 1.3.23
Apache Http Server	Version 1.3.24
Apache Http Server	Version 1.3.25
Apache Http Server	Version 1.3.26
Apache Http Server	Version 1.3.27
Apache Http Server	Version 1.3.28
Apache Http Server	Version 1.3.29
Apache Http Server	Version 1.3.2
Apache Http Server	Version 1.3.30
Apache Http Server	Version 1.3.31
Apache Http Server	Version 1.3.32
Apache Http Server	Version 1.3.33
Apache Http Server	Version 1.3.34
Apache Http Server	Version 1.3.35
Apache Http Server	Version 1.3.36
Apache Http Server	Version 1.3.37
Apache Http Server	Version 1.3.38
Apache Http Server	Version 1.3.39
Apache Http Server	Version 1.3.3
Apache Http Server	Version 1.3.40
Apache Http Server	Version 1.3.4
Apache Http Server	Version 1.3

Related CWEs

References (46)

http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0589.html

Source: secalert@redhat.com

Exploit

http://blog.pi3.com.pl/?p=69

Source: secalert@redhat.com

http://httpd.apache.org/dev/dist/CHANGES_1.3.42

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=130497311408250&w=2

Source: secalert@redhat.com

http://packetstormsecurity.org/1001-exploits/modproxy-overflow.txt

Source: secalert@redhat.com

Exploit

http://secunia.com/advisories/38319

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/39656

Source: secalert@redhat.com

http://site.pi3.com.pl/adv/mod_proxy.txt

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/509185/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/37966

Source: secalert@redhat.com

Exploit

http://www.securitytracker.com/id?1023533

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/0240

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2010/1001

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/55941

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7923

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0589.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://blog.pi3.com.pl/?p=69

Source: af854a3a-2127-422b-91ae-364da2661108

http://httpd.apache.org/dev/dist/CHANGES_1.3.42

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=130497311408250&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.org/1001-exploits/modproxy-overflow.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/38319

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/39656

Source: af854a3a-2127-422b-91ae-364da2661108

http://site.pi3.com.pl/adv/mod_proxy.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/509185/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/37966

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securitytracker.com/id?1023533

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/0240

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2010/1001

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/55941

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r2295080a257bad27ea68ca0af12fc715577f9e84801eae116a33107e%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rad2acee3ab838b52c04a0698b1728a9a43467bf365bd481c993c535d%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/reb7c64aeea604bf948467d9d1cab8ff23fa7d002be1964bcc275aae7%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7923

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.