Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.

A buffer overflow exists in mod_proxy which may allow an attacker to launch local DoS attacks and possibly execute arbitrary code.

New apache and mod_ssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix security issues. Apache has been upgraded to version 1.3.32 which fixes a heap-based buffer overflow in mod_proxy. mod_ssl was upgraded from version mod_ssl-2.8.19-1.3.31 to version 2.8.21-1.3.32 which corrects a flaw allowing a client to use a cipher which the server does not consider secure enough. A new PHP package (php-4.3.9) is also available for all of these platforms.

The remote host is missing Security Update 2004-12-02. This security update contains a number of fixes for the following programs :

  - Apache
  - Apache2
  - AppKit
  - Cyrus IMAP
  - HIToolbox
  - Kerberos
  - Postfix
  - PSNormalizer
  - QuickTime Streaming Server
  - Safari
  - Terminal

These programs contain multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

The remote web server appears to be running a version of Apache that is older than version 1.3.32.

This version is reportedly vulnerable to a heap-based buffer overflow in proxy_util.c for mod_proxy. This issue may lead remote attackers to cause a denial of service and possibly execute arbitrary code on the server.

SunOS 5.8_x86: Apache Patch.
Date this patch was last updated by Sun : Apr/23/08

SunOS 5.8: Apache Patch.
Date this patch was last updated by Sun : Apr/24/08

Georgi Guninski discovered a buffer overflow bug in Apache's mod_proxy module, whereby a remote user could potentially cause arbitrary code to be executed with the privileges of an Apache httpd child process (by default, user www-data). Note that this bug is only exploitable if the mod_proxy module is in use.

Note that this bug exists in a module in the apache-common package, shared by apache, apache-ssl and apache-perl, so this update is sufficient to correct the bug for all three builds of Apache httpd.
However, on systems using apache-ssl or apache-perl, httpd will not automatically be restarted.

The remote host is missing Apple's Security Update 2004-09-07. This security update fixes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump

The remote host is affected by the vulnerability described in GLSA-200406-16 (Apache 1.3: Buffer overflow in mod_proxy)

    A bug in the proxy_util.c file may lead to a remote buffer overflow. To     trigger the vulnerability an attacker would have to get mod_proxy to     connect to a malicous server which returns an invalid (negative)     Content-Length.
  Impact :

    An attacker could cause a Denial of Service as the Apache child handling     the request, which will die and under some circumstances execute arbitrary     code as the user running Apache, usually 'apache'.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version:

A buffer overflow vulnerability was found by George Guninski in Apache's mod_proxy module, which can be exploited by a remote user to potentially execute arbitrary code with the privileges of an httpd child process (user apache). This can only be exploited, however, if mod_proxy is actually in use.

It is recommended that you stop Apache prior to updating and then restart it again once the update is complete ('service httpd stop' and 'service httpd start' respectively).

SunOS 5.9_x86: Apache Security Patch.
Date this patch was last updated by Sun : Mar/05/10

SunOS 5.9: Apache Security Patch.
Date this patch was last updated by Sun : Mar/05/10

Updated httpd and mod_ssl packages that fix minor security issues in the Apache Web server are now available for Red Hat Enterprise Linux 2.1.

The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server.

A buffer overflow was found in the Apache proxy module, mod_proxy, which can be triggered by receiving an invalid Content-Length header.
In order to exploit this issue, an attacker would need an Apache installation that was configured as a proxy to connect to a malicious site. This would cause the Apache child processing the request to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0492 to this issue.

On Red Hat Enterprise Linux platforms Red Hat believes this issue cannot lead to remote code execution. This issue also does not represent a Denial of Service attack as requests will continue to be handled by other Apache child processes.

A stack-based buffer overflow was discovered in mod_ssl which can be triggered if using the FakeBasicAuth option. If mod_ssl is sent a client certificate with a subject DN field longer than 6000 characters, a stack overflow can occur if FakeBasicAuth has been enabled. In order to exploit this issue the carefully crafted malicious certificate would have to be signed by a Certificate Authority which mod_ssl is configured to trust. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0488 to this issue.

This update also fixes a DNS handling bug in mod_proxy.

The mod_auth_digest module is now included in the Apache package and should be used instead of mod_digest for sites requiring Digest authentication.

Red Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade to these erratum packages, which contains Apache version 1.3.27 with backported patches correcting these issues.

ID	Name	Product	Family	Severity
36428	FreeBSD : apache -- heap overflow in mod_proxy (ca6c8f35-0a5f-11d9-ad6f-00061bc2ad93)	Nessus	FreeBSD Local Security Checks	critical
18793	Slackware 10.0 / 8.1 / 9.0 / 9.1 / current : apache, mod_ssl, php (SSA:2004-299-01)	Nessus	Slackware Local Security Checks	critical
15898	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus	MacOS X Local Security Checks	high
15555	Apache mod_proxy Content-Length Overflow	Nessus	Web Servers	critical
15483	Solaris 8 (x86) : 116974-07	Nessus	Solaris Local Security Checks	critical
15482	Solaris 8 (sparc) : 116973-07	Nessus	Solaris Local Security Checks	critical
15362	Debian DSA-525-1 : apache - buffer overflow	Nessus	Debian Local Security Checks	critical
2274	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus Network Monitor	Web Clients	medium
14527	GLSA-200406-16 : Apache 1.3: Buffer overflow in mod_proxy	Nessus	Gentoo Local Security Checks	critical
14164	Mandrake Linux Security Advisory : apache (MDKSA-2004:065)	Nessus	Mandriva Local Security Checks	critical
13593	Solaris 9 (x86) : 114145-12	Nessus	Solaris Local Security Checks	critical
13530	Solaris 9 (sparc) : 113146-13	Nessus	Solaris Local Security Checks	critical
12506	RHEL 2.1 : apache, mod_ssl (RHSA-2004:245)	Nessus	Red Hat Local Security Checks	critical
800802	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0492

critical

Tenable Plugins

critical

critical

high

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

high