Detections
Analytics

Apache Chunked Encoding Remote Overflow

high Nessus Plugin ID 11030

Language:

Synopsis

The remote web server is vulnerable to a remote code execution attack.

Description

The remote Apache web server is affected by the Apache web server chunk handling vulnerability.

If safe checks are enabled, this may be a false positive since it is based on the version of Apache. Although unpatched Apache versions 1.2.2 and above, 1.3 through 1.3.24, and 2.0 through 2.0.36 are affected, the remote server may be running a patched version of Apache.

Solution

Upgrade to Apache web server version 1.3.26 / 2.0.39 or later.

See Also

http://httpd.apache.org/info/security_bulletin_20020617.txt

http://httpd.apache.org/info/security_bulletin_20020620.txt

Plugin Details

Severity: High

ID: 11030

File Name: apache_chunked_encoding.nasl

Version: 1.56

Type: remote

Family: Web Servers

Published: 6/17/2002

Updated: 6/12/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:http_server

Required KB Items: installed_sw/Apache

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/19/2002

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Apache Win32 Chunked Encoding)

Reference Information

CVE: CVE-2002-0392

BID: 5033