Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.

Red Hat Network Proxy Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The Red Hat Network Proxy Server 4.2.3 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752, CVE-2006-3918, CVE-2005-3352)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

New mod_ssl packages are available for Slackware 8.1, 9.0, 9.1, and
-current to fix a security issue. The packages were upgraded to mod_ssl-2.8.18-1.3.31 fixing a buffer overflow that may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN, if mod_ssl is configured to trust the issuing CA.
Websites running mod_ssl should upgrade to the new set of apache and mod_ssl packages. There are new PHP packages as well to fix a Slackware-specific local denial-of-service issue (an additional Slackware advisory SSA:2004-154-02 has been issued for PHP).

The remote host is missing Security Update 2004-12-02. This security update contains a number of fixes for the following programs :

  - Apache
  - Apache2
  - AppKit
  - Cyrus IMAP
  - HIToolbox
  - Kerberos
  - Postfix
  - PSNormalizer
  - QuickTime Streaming Server
  - Safari
  - Terminal

These programs contain multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

Two vulnerabilities were discovered in libapache-mod-ssl :

  - CAN-2004-0488     Stack-based buffer overflow in the     ssl_util_uuencode_binary function in ssl_util.c for     Apache mod_ssl, when mod_ssl is configured to trust the     issuing CA, may allow remote attackers to execute     arbitrary code via a client certificate with a long     subject DN.

  - CAN-2004-0700

    Format string vulnerability in the ssl_log function in     ssl_engine_log.c in mod_ssl 2.8.19 for Apache 1.3.31 may     allow remote attackers to execute arbitrary messages via     format string specifiers in certain log messages for     HTTPS.

The remote host is missing Apple's Security Update 2004-09-07. This security update fixes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump

The remote host is missing Security Update 2004-09-07.  This security update fixes the following components :

  - CoreFoundation
  - IPSec
  - Kerberos
  - libpcap
  - lukemftpd
  - NetworkConfig
  - OpenLDAP
  - OpenSSH
  - PPPDialer
  - rsync
  - Safari
  - tcpdump

These applications contain multiple vulnerabilities that may allow a remote attacker to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200406-05 (Apache: Buffer overflow in mod_ssl)

    A bug in the function ssl_util_uuencode_binary in ssl_util.c may lead to a     remote buffer overflow on a server configured to use FakeBasicAuth that     will trust a client certificate with an issuing CA with a subject DN longer     than 6k.
  Impact :

    Given the right server configuration, an attacker could cause a Denial of     Service or execute code as the user running Apache, usually     'apache'. It is thought to be impossible to exploit this to     execute code on the x86 platform, but the possibility for other platforms     is unknown. This does not preclude a DoS on x86 systems.
  Workaround :

    A server should not be vulnerable if it is not configured to use     FakeBasicAuth and to trust a client CA with a long subject DN.

A stack-based buffer overflow exists in the ssl_util_uuencode_binary function in ssl_util.c in Apache. When mod_ssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN.

The provided packages are patched to prevent this problem.

A stack-based buffer overflow exists in the ssl_util_uuencode_binary function in ssl_engine_kernel.c in mod_ssl for Apache 1.3.x. When mod_ssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN.

The provided packages are patched to prevent this problem.

Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely triggerable memory leak are now available.

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server.

A stack-based buffer overflow was discovered in mod_ssl that could be triggered if using the FakeBasicAuth option. If mod_ssl was sent a client certificate with a subject DN field longer than 6000 characters, a stack overflow occured if FakeBasicAuth had been enabled. In order to exploit this issue the carefully crafted malicious certificate would have had to be signed by a Certificate Authority which mod_ssl is configured to trust. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0488 to this issue.

A remotely triggered memory leak in the Apache HTTP Server earlier than version 2.0.50 was also discovered. This allowed a remote attacker to perform a denial of service attack against the server by forcing it to consume large amounts of memory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0493 to this issue.

Users of the Apache HTTP server should upgrade to these updated packages, which contain backported patches that address these issues.

Updated httpd and mod_ssl packages that fix minor security issues in the Apache Web server are now available for Red Hat Enterprise Linux 2.1.

The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server.

A buffer overflow was found in the Apache proxy module, mod_proxy, which can be triggered by receiving an invalid Content-Length header.
In order to exploit this issue, an attacker would need an Apache installation that was configured as a proxy to connect to a malicious site. This would cause the Apache child processing the request to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0492 to this issue.

On Red Hat Enterprise Linux platforms Red Hat believes this issue cannot lead to remote code execution. This issue also does not represent a Denial of Service attack as requests will continue to be handled by other Apache child processes.

A stack-based buffer overflow was discovered in mod_ssl which can be triggered if using the FakeBasicAuth option. If mod_ssl is sent a client certificate with a subject DN field longer than 6000 characters, a stack overflow can occur if FakeBasicAuth has been enabled. In order to exploit this issue the carefully crafted malicious certificate would have to be signed by a Certificate Authority which mod_ssl is configured to trust. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0488 to this issue.

This update also fixes a DNS handling bug in mod_proxy.

The mod_auth_digest module is now included in the Apache package and should be used instead of mod_digest for sites requiring Digest authentication.

Red Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade to these erratum packages, which contains Apache version 1.3.27 with backported patches correcting these issues.

The remote host is using a version of mod_ssl that is older than 2.8.18. 

This version is vulnerable to a flaw that could allow an attacker to disable the remote website remotely, or to execute arbitrary code on the remote host. 

Note that several Linux distributions patched the old version of this module.  Therefore, this alert might be a false-positive.  Please check with your vendor to determine if you really are vulnerable to this flaw.

ID	Name	Product	Family	Severity
63857	RHEL 3 / 4 : Proxy Server (RHSA-2008:0523)	Nessus	Red Hat Local Security Checks	high
18790	Slackware 8.1 / 9.0 / 9.1 / current : mod_ssl (SSA:2004-154-01)	Nessus	Slackware Local Security Checks	high
15898	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus	MacOS X Local Security Checks	high
15369	Debian DSA-532-2 : libapache-mod-ssl - several vulnerabilities	Nessus	Debian Local Security Checks	high
2274	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus Network Monitor	Web Clients	medium
14676	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus	MacOS X Local Security Checks	high
14516	GLSA-200406-05 : Apache: Buffer overflow in mod_ssl	Nessus	Gentoo Local Security Checks	high
14154	Mandrake Linux Security Advisory : apache2 (MDKSA-2004:055)	Nessus	Mandriva Local Security Checks	high
14153	Mandrake Linux Security Advisory : mod_ssl (MDKSA-2004:054)	Nessus	Mandriva Local Security Checks	high
12636	RHEL 3 : httpd (RHSA-2004:342)	Nessus	Red Hat Local Security Checks	high
12506	RHEL 2.1 : apache, mod_ssl (RHSA-2004:245)	Nessus	Red Hat Local Security Checks	critical
12255	mod_ssl ssl_util_uuencode_binary Remote Overflow	Nessus	Web Servers	high
800802	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0488

critical

Tenable Plugins

high

high

high

high

medium

high

high

high

high

high

critical

high

high