Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.

An attacker may cause Apache with mod_python to crash by using a specially constructed query string.

The Apache Software Foundation announced that some versions of mod_python contain a bug which, when processing a request with a malformed query string, could cause the corresponding Apache child to crash. This bug could be exploited by a remote attacker to cause a denial of service.

Updated mod_python packages that fix a denial of service vulnerability are now available for Red Hat Enterprise Linux.

mod_python embeds the Python language interpreter within the Apache httpd server.

A bug has been found in mod_python versions 2.7.10 and earlier that can lead to a denial of service vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0973 to this issue.

Although Red Hat Enterprise Linux shipped with a version of mod_python that contains this bug, our testing was unable to trigger the denial of service vulnerability. However, mod_python users are advised to upgrade to these errata packages, which contain a backported patch that corrects this bug.

The remote host is using the Apache mod_python module older than 2.7.9 or 3.0.4. These versions may be prone to a denial of service attacks when handling malformed queries.

ID	Name	Product	Family	Severity
36819	FreeBSD : mod_python denial-of-service vulnerability in parse_qs (1a448eb7-6988-11d8-873f-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
15289	Debian DSA-452-1 : libapache-mod-python - denial of service	Nessus	Debian Local Security Checks	medium
12464	RHEL 2.1 / 3 : mod_python (RHSA-2004:058)	Nessus	Red Hat Local Security Checks	medium
11937	mod_python < 2.7.9 / 3.0.4 Malformed Query String DoS	Nessus	Web Servers	medium

Detections

Analytics

CVE-2003-0973

high

Tenable Plugins

medium

medium

medium

medium