Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

Red Hat Network Proxy Server version 4.2.3 is now available. This update includes fixes for a number of security issues in Red Hat Network Proxy Server components.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The Red Hat Network Proxy Server 4.2.3 release corrects several security vulnerabilities in several shipped components. In a typical operating environment, these components are not exposed to users of Proxy Server in a vulnerable manner. These security updates will reduce risk in unique Proxy Server environments.

Multiple flaws were fixed in the Apache HTTPD server. These flaws could result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752, CVE-2006-3918, CVE-2005-3352)

A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)

Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)

A denial-of-service flaw was fixed in the jabberd server.
(CVE-2006-1329)

Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3, which resolves these issues.

A OpenPKG Security Advisory reports :

Triggered by a report to Packet Storm from Virulent, a format string vulnerability was found in mod_ssl, the Apache SSL/TLS interface to OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability could be exploitable if Apache is used as a proxy for HTTPS URLs and the attacker established a own specially prepared DNS and origin server environment.

Apache did not honour the 'SSLVerifyClient require' directive within a <Location> block if the surrounding <VirtualHost> block contained a directive 'SSLVerifyClient optional'. This allowed clients to bypass client certificate validation on servers with the above configuration.
(CAN-2005-2700)

Filip Sneppe discovered a Denial of Service vulnerability in the byte range filter handler. By requesting certain large byte ranges, a remote attacker could cause memory exhaustion in the server.
(CAN-2005-2728)

The updated libapache-mod-ssl also fixes two older Denial of Service vulnerabilities: A format string error in the ssl_log() function which could be exploited to crash the server (CAN-2004-0700), and a flaw in the SSL cipher negotiation which could be exploited to terminate a session (CAN-2004-0885). Please note that Apache 1.3 and libapache-mod-ssl are not officially supported (they are in the 'universe' component of the Ubuntu archive).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities were discovered in libapache-mod-ssl :

  - CAN-2004-0488     Stack-based buffer overflow in the     ssl_util_uuencode_binary function in ssl_util.c for     Apache mod_ssl, when mod_ssl is configured to trust the     issuing CA, may allow remote attackers to execute     arbitrary code via a client certificate with a long     subject DN.

  - CAN-2004-0700

    Format string vulnerability in the ssl_log function in     ssl_engine_log.c in mod_ssl 2.8.19 for Apache 1.3.31 may     allow remote attackers to execute arbitrary messages via     format string specifiers in certain log messages for     HTTPS.

The remote host is missing Apple's Security Update 2004-09-07. This security update fixes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump

An updated mod_ssl package for Apache that fixes a format string vulnerability is now available.

The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols.

A format string issue was discovered in mod_ssl for Apache 1.3 which can be triggered if mod_ssl is configured to allow a client to proxy to remote SSL sites. In order to exploit this issue, a user who is authorized to use Apache as a proxy would have to attempt to connect to a carefully crafted hostname via SSL. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0700 to this issue.

Users of mod_ssl should upgrade to this updated package, which contains a backported patch to correct this issue.

Ralf S. Engelschall found a remaining risky call to ssl_log while reviewing code for another issue reported by Virulent. The updated packages are patched to correct the problem.

The remote host is using a version vulnerable of mod_ssl which is older than 2.8.19. There is a format string condition in the log functions of the remote module which may allow an attacker to execute arbitrary code on the remote host.

*** Some vendors patched older versions of mod_ssl, so this
*** might be a false positive. Check with your vendor to determine
*** if you have a version of mod_ssl that is patched for this
*** vulnerability

ID	Name	Product	Family	Severity
63857	RHEL 3 / 4 : Proxy Server (RHSA-2008:0523)	Nessus	Red Hat Local Security Checks	high
36579	FreeBSD : apache13-modssl -- format string vulnerability in proxy support (18974c8a-1fbd-11d9-814e-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
20587	Ubuntu 4.10 / 5.04 : apache2, libapache-mod-ssl vulnerabilities (USN-177-1)	Nessus	Ubuntu Local Security Checks	critical
15369	Debian DSA-532-2 : libapache-mod-ssl - several vulnerabilities	Nessus	Debian Local Security Checks	high
2274	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus Network Monitor	Web Clients	medium
14698	RHEL 2.1 : mod_ssl (RHSA-2004:408)	Nessus	Red Hat Local Security Checks	high
14173	Mandrake Linux Security Advisory : mod_ssl (MDKSA-2004:075)	Nessus	Mandriva Local Security Checks	high
13651	Apache mod_ssl ssl_engine_log.c mod_proxy Hook Function Remote Format String	Nessus	Web Servers	high
800802	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0700

critical

Tenable Plugins

high

high

critical

high

medium

high

high

high

high