5 - USN-160-1

Executive Summary

Summary
Title	Apache 2 vulnerabilities

Informations
Name	USN-160-1	First vendor Publication	2005-08-04
Vendor	Ubuntu	Last vendor Modification	2005-08-04
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:

apache2-mpm-perchild apache2-mpm-prefork apache2-mpm-threadpool apache2-mpm-worker

The problem can be corrected by upgrading the affected package to version 2.0.50-12ubuntu4.3 (for Ubuntu 4.10), or 2.0.53-5ubuntu5.2 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes.

Details follow:

Marc Stern discovered a buffer overflow in the SSL module's certificate revocation list (CRL) handler. If Apache is configured to use a malicious CRL, this could possibly lead to a server crash or arbitrary code execution with the privileges of the Apache web server. (CAN-2005-1268)

Watchfire discovered that Apache insufficiently verified the "Transfer-Encoding" and "Content-Length" headers when acting as an HTTP proxy. By sending a specially crafted HTTP request, a remote attacker who is authorized to use the proxy could exploit this to bypass web application firewalls, poison the HTTP proxy cache, and conduct cross-site scripting attacks against other proxy users. (CAN-2005-2088)

Original Source

Url : http://www.ubuntu.com/usn/USN-160-1

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-33	HTTP Request Smuggling
CAPEC-105	HTTP Request Splitting

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-444	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
50 %	CWE-193	Off-by-one Error

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11452

Oval ID:	oval:org.mitre.oval:def:11452
Title:	The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Description:	The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2088	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section httpd-devel is earlier than 0:2.0.46-46.2.ent AND mod_ssl is earlier than 1:2.0.46-46.2.ent AND httpd is earlier than 0:2.0.46-46.2.ent OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section httpd-suexec is earlier than 0:2.0.52-12.1.ent AND httpd-manual is earlier than 0:2.0.52-12.1.ent AND httpd-devel is earlier than 0:2.0.52-12.1.ent AND mod_ssl is earlier than 1:2.0.52-12.1.ent AND httpd is earlier than 0:2.0.52-12.1.ent

Definition Id: oval:org.mitre.oval:def:1237

Oval ID:	oval:org.mitre.oval:def:1237
Title:	Webproxy HTTP Request Smuggling (B.11.04)
Description:	The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2088	Version:	5
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
VirtualvaultTS A.04.70 is installed without patch PHSS_34169 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND VirtualvaultTS A.04.70 is installed AND NOT Patch PHSS_34169 is installed OR VirtualvaultWS A.04.70 is installed without patch PHSS_34121 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND VirtualvaultWS A.04.70 is installed AND NOT Patch PHSS_34121 is installed OR VirtualvaultTS A.04.60 is installed without patch PHSS_34170 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND VirtualvaultTS A.04.60 is installed AND NOT Patch PHSS_34170 is installed OR VirtualvaultWS A.04.60 is installed without patch PHSS_34120 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND VirtualvaultWS A.04.60 is installed AND NOT Patch PHSS_34120 is installed OR VirtualvaultTS A.04.50 is installed without patch PHSS_34171 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND VirtualvaultTS A.04.50 is installed AND NOT Patch PHSS_34171 is installed OR VirtualvaultWS A.04.50 is installed without patch PHSS_34119 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND VirtualvaultWS A.04.50 is installed AND NOT Patch PHSS_34119 is installed OR HP_Webproxy.HPWEB-PX-CORE A.02.10 is installed without patch PHSS_34203 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND HP_Webproxy.HPWEB-PX-CORE A.02.10 is installed AND NOT Patch PHSS_34203 is installed OR HP_Webproxy.HPWEB-PX-CORE A.02.00 is installed without patch PHSS_34204 or later 700 Series or 800 Series OS Release 11.04 700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 OR 800 Series OS Release 11.04 800-series HP AND HP Release B.11.04 AND HP_Webproxy.HPWEB-PX-CORE A.02.00 is installed AND NOT Patch PHSS_34204 is installed

Definition Id: oval:org.mitre.oval:def:1346

Oval ID:	oval:org.mitre.oval:def:1346
Title:	Apache mod_ssl CRL off-by-one DoS
Description:	Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-1268	Version:	1
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
700 Series or 800 Series OS Release 11.00, 11.11, or 11.23 700 Series or 800 Series OS Release 11.11 700 Series OS Release 11.11 700-series HP AND HP Release B.11.11 OR 800 Series OS Release 11.11 800-series HP AND HP Release B.11.11 OR 700 Series or 800 Series OS Release 11.00 700 Series OS Release 11.00 700-series HP AND HP Release B.11.00 OR 800 Series OS Release 11.00 800-series HP AND HP Release B.11.00 OR 700 Series or 800 Series OS Release 11.23 700 Series OS Release 11.23 700-series HP AND HP Release B.11.23 OR 800 Series OS Release 11.23 800-series HP AND HP Release B.11.23 AND hpuxwsAPACHE is installed AND NOT hpuxwsAPACHE has a version greater than or equal (A\|B).2.0.55.0

Definition Id: oval:org.mitre.oval:def:1526

Oval ID:	oval:org.mitre.oval:def:1526
Title:	VirusVault HTTP Request Smuggling
Description:	The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2088	Version:	2
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 AND VirusVault is installed AND NOT Patch PHSS_34123 is installed

Definition Id: oval:org.mitre.oval:def:1629

Oval ID:	oval:org.mitre.oval:def:1629
Title:	Webproxy HTTP Request Smuggling
Description:	The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2088	Version:	2
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 AND Webproxy is installed AND NOT Patch PHSS_34163 is installed

Definition Id: oval:org.mitre.oval:def:1714

Oval ID:	oval:org.mitre.oval:def:1714
Title:	VirusVault Off-by-One Error in mod_ssl CRL
Description:	Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-1268	Version:	2
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 AND VirusVault is installed AND NOT Patch PHSS_34123 is installed

Definition Id: oval:org.mitre.oval:def:1747

Oval ID:	oval:org.mitre.oval:def:1747
Title:	Webproxy Off-by-One Error in mod_ssl CRL
Description:	Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-1268	Version:	2
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
700 Series OS Release 11.04 700-series HP AND HP Release B.11.04 AND Webproxy is installed AND NOT Patch PHSS_34163 is installed

Definition Id: oval:org.mitre.oval:def:840

Oval ID:	oval:org.mitre.oval:def:840
Title:	Apache HTTP Request Smuggling
Description:	The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Apache to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-2088	Version:	1
Platform(s):	HP-UX 11	Product(s):	Apache
Definition Synopsis:
700 Series or 800 Series OS Release 11.00, 11.11, or 11.23 700 Series or 800 Series OS Release 11.11 700 Series OS Release 11.11 700-series HP AND HP Release B.11.11 OR 800 Series OS Release 11.11 800-series HP AND HP Release B.11.11 OR 700 Series or 800 Series OS Release 11.00 700 Series OS Release 11.00 700-series HP AND HP Release B.11.00 OR 800 Series OS Release 11.00 800-series HP AND HP Release B.11.00 OR 700 Series or 800 Series OS Release 11.23 700 Series OS Release 11.23 700-series HP AND HP Release B.11.23 OR 800 Series OS Release 11.23 800-series HP AND HP Release B.11.23 AND hpuxwsAPACHE is installed AND NOT hpuxwsAPACHE has a version greater than or equal (A\|B).2.0.55.0

Definition Id: oval:org.mitre.oval:def:9589

Oval ID:	oval:org.mitre.oval:def:9589
Title:	Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
Description:	Off-by-one error in the mod_ssl Certificate Revocation List (CRL) verification callback in Apache, when configured to use a CRL, allows remote attackers to cause a denial of service (child process crash) via a CRL that causes a buffer overflow of one null byte.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2005-1268	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section httpd-devel is earlier than 0:2.0.46-46.2.ent AND mod_ssl is earlier than 1:2.0.46-46.2.ent AND httpd is earlier than 0:2.0.46-46.2.ent OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section httpd-suexec is earlier than 0:2.0.52-12.1.ent AND httpd-manual is earlier than 0:2.0.52-12.1.ent AND httpd-devel is earlier than 0:2.0.52-12.1.ent AND mod_ssl is earlier than 1:2.0.52-12.1.ent AND httpd is earlier than 0:2.0.52-12.1.ent

CPE : Common Platform Enumeration

Type	Description	Count
Application	Apache Http Server cpe:2.3:a:apache:http_server:2.0.9:::::::* cpe:2.3:a:apache:http_server:2.0.54:::::::* cpe:2.3:a:apache:http_server:2.0.53:::::::* cpe:2.3:a:apache:http_server:2.0.52:::::::* cpe:2.3:a:apache:http_server:2.0.51:::::::* cpe:2.3:a:apache:http_server:2.0.50:::::::* cpe:2.3:a:apache:http_server:2.0.49:::::::* cpe:2.3:a:apache:http_server:2.0.48:::::::* cpe:2.3:a:apache:http_server:2.0.47:::::::* cpe:2.3:a:apache:http_server:2.0.46:::::::* cpe:2.3:a:apache:http_server:2.0.46::win32::::: cpe:2.3:a:apache:http_server:2.0.45:::::::* cpe:2.3:a:apache:http_server:2.0.44:::::::* cpe:2.3:a:apache:http_server:2.0.43:::::::* cpe:2.3:a:apache:http_server:2.0.42:::::::* cpe:2.3:a:apache:http_server:2.0.41:::::::* cpe:2.3:a:apache:http_server:2.0.40:::::::* cpe:2.3:a:apache:http_server:2.0.39:::::::* cpe:2.3:a:apache:http_server:2.0.38:::::::* cpe:2.3:a:apache:http_server:2.0.37:::::::* cpe:2.3:a:apache:http_server:2.0.36:::::::* cpe:2.3:a:apache:http_server:2.0.35:::::::* cpe:2.3:a:apache:http_server:2.0.34:beta:::::: cpe:2.3:a:apache:http_server:2.0.34:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.34:::::::* cpe:2.3:a:apache:http_server:2.0.33:::::::* cpe:2.3:a:apache:http_server:2.0.32:beta:::::: cpe:2.3:a:apache:http_server:2.0.32:::::::* cpe:2.3:a:apache:http_server:2.0.32:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.31:::::::* cpe:2.3:a:apache:http_server:2.0.30:::::::* cpe:2.3:a:apache:http_server:2.0.29:::::::* cpe:2.3:a:apache:http_server:2.0.28:beta:::::: cpe:2.3:a:apache:http_server:2.0.28:::::::* cpe:2.3:a:apache:http_server:2.0.28:beta:win32:::::* cpe:2.3:a:apache:http_server:2.0.27:::::::* cpe:2.3:a:apache:http_server:2.0.26:::::::* cpe:2.3:a:apache:http_server:2.0.25:::::::* cpe:2.3:a:apache:http_server:2.0.24:::::::* cpe:2.3:a:apache:http_server:2.0.23:::::::* cpe:2.3:a:apache:http_server:2.0.22:::::::* cpe:2.3:a:apache:http_server:2.0.21:::::::* cpe:2.3:a:apache:http_server:2.0.20:::::::* cpe:2.3:a:apache:http_server:2.0.19:::::::* cpe:2.3:a:apache:http_server:2.0.18:::::::* cpe:2.3:a:apache:http_server:2.0.17:::::::* cpe:2.3:a:apache:http_server:2.0.16:::::::* cpe:2.3:a:apache:http_server:2.0.15:::::::* cpe:2.3:a:apache:http_server:2.0.14:::::::* cpe:2.3:a:apache:http_server:2.0.13:::::::* cpe:2.3:a:apache:http_server:2.0.12:::::::* cpe:2.3:a:apache:http_server:2.0.11:::::::* cpe:2.3:a:apache:http_server:2.0.0:::::::* cpe:2.3:a:apache:http_server:2.0:::::::* cpe:2.3:a:apache:http_server:2.0:alpha9:::::: cpe:2.3:a:apache:http_server:1.99:::::::* cpe:2.3:a:apache:http_server:1.4.0:::::::* cpe:2.3:a:apache:http_server:1.3.9:::::::* cpe:2.3:a:apache:http_server:1.3.9::win32::::: cpe:2.3:a:apache:http_server:1.3.8:::::::* cpe:2.3:a:apache:http_server:1.3.7:::::::* cpe:2.3:a:apache:http_server:1.3.7::dev::::: cpe:2.3:a:apache:http_server:1.3.68:::::::* cpe:2.3:a:apache:http_server:1.3.65:::::::* cpe:2.3:a:apache:http_server:1.3.6:::::::* cpe:2.3:a:apache:http_server:1.3.6::win32::::: cpe:2.3:a:apache:http_server:1.3.5:::::::* cpe:2.3:a:apache:http_server:1.3.42:::::::* cpe:2.3:a:apache:http_server:1.3.41:::::::* cpe:2.3:a:apache:http_server:1.3.40:::::::* cpe:2.3:a:apache:http_server:1.3.4:::::::* cpe:2.3:a:apache:http_server:1.3.39:::::::* cpe:2.3:a:apache:http_server:1.3.38:::::::* cpe:2.3:a:apache:http_server:1.3.37:::::::* cpe:2.3:a:apache:http_server:1.3.36:::::::* cpe:2.3:a:apache:http_server:1.3.35:::::::* cpe:2.3:a:apache:http_server:1.3.34:::::::* cpe:2.3:a:apache:http_server:1.3.33:::::::* cpe:2.3:a:apache:http_server:1.3.32:::::::* cpe:2.3:a:apache:http_server:1.3.31:::::::* cpe:2.3:a:apache:http_server:1.3.30:::::::* cpe:2.3:a:apache:http_server:1.3.3:::::::* cpe:2.3:a:apache:http_server:1.3.29:::::::* cpe:2.3:a:apache:http_server:1.3.28:::::::* cpe:2.3:a:apache:http_server:1.3.27:::::::* cpe:2.3:a:apache:http_server:1.3.26:::::::* cpe:2.3:a:apache:http_server:1.3.26::win32::::: cpe:2.3:a:apache:http_server:1.3.25:::::::* cpe:2.3:a:apache:http_server:1.3.25::win32::::: cpe:2.3:a:apache:http_server:1.3.24:::::::* cpe:2.3:a:apache:http_server:1.3.24::win32::::: cpe:2.3:a:apache:http_server:1.3.23:::::::* cpe:2.3:a:apache:http_server:1.3.23::win32::::: cpe:2.3:a:apache:http_server:1.3.22:::::::* cpe:2.3:a:apache:http_server:1.3.22::win32::::: cpe:2.3:a:apache:http_server:1.3.20:::::::* cpe:2.3:a:apache:http_server:1.3.20::win32::::: cpe:2.3:a:apache:http_server:1.3.2:::::::* cpe:2.3:a:apache:http_server:1.3.19:::::::* cpe:2.3:a:apache:http_server:1.3.19::win32::::: cpe:2.3:a:apache:http_server:1.3.18:::::::* cpe:2.3:a:apache:http_server:1.3.18::win32::::: cpe:2.3:a:apache:http_server:1.3.17:::::::* cpe:2.3:a:apache:http_server:1.3.17::win32::::: cpe:2.3:a:apache:http_server:1.3.16:::::::* cpe:2.3:a:apache:http_server:1.3.16::win32::::: cpe:2.3:a:apache:http_server:1.3.15:::::::* cpe:2.3:a:apache:http_server:1.3.15::win32::::: cpe:2.3:a:apache:http_server:1.3.14:::::::* cpe:2.3:a:apache:http_server:1.3.14::win32::::: cpe:2.3:a:apache:http_server:1.3.14::mac_os::::: cpe:2.3:a:apache:http_server:1.3.13:::::::* cpe:2.3:a:apache:http_server:1.3.13::win32::::: cpe:2.3:a:apache:http_server:1.3.12:::::::* cpe:2.3:a:apache:http_server:1.3.12::win32::::: cpe:2.3:a:apache:http_server:1.3.11:::::::* cpe:2.3:a:apache:http_server:1.3.11::win32::::: cpe:2.3:a:apache:http_server:1.3.10:::::::* cpe:2.3:a:apache:http_server:1.3.1.1:::::::* cpe:2.3:a:apache:http_server:1.3.1:::::::* cpe:2.3:a:apache:http_server:1.3.0:::::::* cpe:2.3:a:apache:http_server:1.3:::::::* cpe:2.3:a:apache:http_server:1.2.9:::::::* cpe:2.3:a:apache:http_server:1.2.6:::::::* cpe:2.3:a:apache:http_server:1.2.5:::::::* cpe:2.3:a:apache:http_server:1.2.4:::::::* cpe:2.3:a:apache:http_server:1.2.0:::::::* cpe:2.3:a:apache:http_server:1.15.17:::::::* cpe:2.3:a:apache:http_server:1.1.1:::::::* cpe:2.3:a:apache:http_server:1.1:::::::* cpe:2.3:a:apache:http_server:1.0.5:::::::* cpe:2.3:a:apache:http_server:1.0.3:::::::* cpe:2.3:a:apache:http_server:1.0.2:::::::* cpe:2.3:a:apache:http_server:1.0:::::::* cpe:2.3:a:apache:http_server:0.8.14:::::::* cpe:2.3:a:apache:http_server:0.8.11:::::::* cpe:2.3:a:apache:http_server:::::::: cpe:2.3:a:apache:http_server:::win32:::::* cpe:2.3:a:apache:http_server:-:::::::*	139
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:3.1:::::::* cpe:2.3:o:debian:debian_linux:3.0:::::::*	2
Os	Redhat Enterprise Linux Desktop cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*	2
Os	Redhat Enterprise Linux Server cpe:2.3:o:redhat:enterprise_linux_server:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_server:3.0:::::::*	2
Os	Redhat Enterprise Linux Workstation cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:::::::* cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:::::::*	2

OpenVAS Exploits

Date	Description
2010-02-03	Name : Solaris Update for Apache 1.3 122912-19 File : nvt/gb_solaris_122912_19.nasl
2010-02-03	Name : Solaris Update for Apache 1.3 122911-19 File : nvt/gb_solaris_122911_19.nasl
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-10-13	Name : Solaris Update for Apache 1.3 122912-17 File : nvt/gb_solaris_122912_17.nasl
2009-10-13	Name : Solaris Update for Apache 1.3 122911-17 File : nvt/gb_solaris_122911_17.nasl
2009-10-10	Name : SLES9: Security update for apache and mod_ssl File : nvt/sles9p5018822.nasl
2009-10-10	Name : SLES9: Security update for Apache 2 oes/CORE File : nvt/sles9p5014064.nasl
2009-09-23	Name : Solaris Update for Apache 1.3 122911-16 File : nvt/gb_solaris_122911_16.nasl
2009-09-23	Name : Solaris Update for Apache 1.3 122912-16 File : nvt/gb_solaris_122912_16.nasl
2009-06-03	Name : Solaris Update for Apache 1.3 122911-15 File : nvt/gb_solaris_122911_15.nasl
2009-06-03	Name : Solaris Update for Apache 116974-07 File : nvt/gb_solaris_116974_07.nasl
2009-06-03	Name : Solaris Update for Apache 1.3 122912-15 File : nvt/gb_solaris_122912_15.nasl
2009-06-03	Name : Solaris Update for Apache 116973-07 File : nvt/gb_solaris_116973_07.nasl
2009-06-03	Name : Solaris Update for Apache Security 114145-11 File : nvt/gb_solaris_114145_11.nasl
2009-06-03	Name : Solaris Update for Apache Security 113146-12 File : nvt/gb_solaris_113146_12.nasl
2008-09-04	Name : FreeBSD Ports: apache File : nvt/freebsd_apache9.nasl
2008-09-04	Name : FreeBSD Ports: apache File : nvt/freebsd_apache8.nasl
2008-01-17	Name : Debian Security Advisory DSA 803-1 (apache) File : nvt/deb_803_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 805-1 (apache2) File : nvt/deb_805_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
18286	Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow Apache HTTP Server contains a flaw that may allow a remote attacker to gain privileges. The issue is due to the mod_ssl extension module not properly validating Certificate Revocation Lists (CRL). By sending a crafted CRL, an attacker can exploit an off-by-one error in mod_ssl to cause a buffer overflow. This may allow the attacker to crash the web server or potentially execute arbitrary code.
17738	Apache HTTP Server HTTP Request Smuggling

Description

18286

Apache HTTP Server mod_ssl ssl_callback_SSLVerify_CRL( ) Function Overflow

Apache HTTP Server contains a flaw that may allow a remote attacker to gain privileges. The issue is due to the mod_ssl extension module not properly validating Certificate Revocation Lists (CRL). By sending a crafted CRL, an attacker can exploit an off-by-one error in mod_ssl to cause a buffer overflow. This may allow the attacker to crash the web server or potentially execute arbitrary code.

17738

Apache HTTP Server HTTP Request Smuggling

Snort® IPS/IDS

Date	Description
2014-01-10	Content-Length request offset smuggling attempt RuleID : 16218 - Revision : 10 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date	Description
2008-03-26	Name : The remote version of Apache is affected by multiple vulnerabilities. File : apache_2_0_55.nasl - Type : ACT_GATHER_INFO
2006-07-03	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-582.nasl - Type : ACT_GATHER_INFO
2006-05-13	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_e936d612253f11dabc01000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34163.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34204.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34203.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34171.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34170.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34169.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34123.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34121.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34120.nasl - Type : ACT_GATHER_INFO
2006-03-21	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34119.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-160-1.nasl - Type : ACT_GATHER_INFO
2006-01-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-160-2.nasl - Type : ACT_GATHER_INFO
2005-11-30	Name : The remote operating system is missing a vendor-supplied patch. File : macosx_SecUpd2005-009.nasl - Type : ACT_GATHER_INFO
2005-11-07	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2005-310-04.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-129.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-130.nasl - Type : ACT_GATHER_INFO
2005-10-05	Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2005_046.nasl - Type : ACT_GATHER_INFO
2005-09-12	Name : The remote Debian host is missing a security-related update. File : debian_DSA-805.nasl - Type : ACT_GATHER_INFO
2005-09-12	Name : The remote Debian host is missing a security-related update. File : debian_DSA-803.nasl - Type : ACT_GATHER_INFO
2005-08-03	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-639.nasl - Type : ACT_GATHER_INFO
2005-08-03	Name : The remote Fedora Core host is missing a security update. File : fedora_2005-638.nasl - Type : ACT_GATHER_INFO
2005-08-01	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_651996e0fe0711d98329000e0c2e438a.nasl - Type : ACT_GATHER_INFO
2005-07-25	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-582.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 12:00:53	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	2
CWE ID(s)	3
Oval ID(s)	9
CPE ID(s)	147
osvdb(s)	2
Openvas Exploit(s)	19
Snort® Rule(s)	1
Nessus® Exploit(s)	26

	Related
5	CVE-2005-1268
4.3	CVE-2005-2088
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

5 - USN-160-1

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CAPEC : Common Attack Pattern Enumeration & Classification

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Snort® IPS/IDS

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU