CVE-2004-0748
CVSS5.0
发布时间 :2004-10-20 00:00:00
修订时间 :2010-08-21 00:21:11
NMCOPS    

[原文]mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in a way that causes an Apache child process to enter an infinite loop.


[CNNVD]Apache Mod_SSL远程拒绝服务漏洞(CNNVD-200410-045)

        
        Mod_SSL是Apache服务器上的SSL实现,用来为Apache Web服务器提供加密支持。
        Apache Mod_SSL中包含一个输入过滤错误,远程攻击者可以利用这个漏洞对mod_ssl服务进行拒绝服务攻击。
        报告者使用第三方工具对使用mod_ssl服务的Apache进行测试,发现在ssl_io_input_getline()函数中存在一个漏洞。Apache在部分状态下没有关闭过滤器的SSL连接,相反是持续读取GETLINE/阻塞模式下的空闲请求。这样会导致ssl_io_input_getline()函数持续循环调用ssl_io_input_read(),造成消耗大量CPU资源,大量此类请求可导致服务停止响应,产生拒绝服务。
        

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:apache:http_server:2.0.47Apache Software Foundation Apache HTTP Server 2.0.47
cpe:/a:apache:http_server:2.0.49Apache Software Foundation Apache HTTP Server 2.0.49
cpe:/a:apache:http_server:2.0.28Apache Software Foundation Apache HTTP Server 2.0.28
cpe:/a:apache:http_server:2.0.48Apache Software Foundation Apache HTTP Server 2.0.48
cpe:/a:apache:http_server:2.0.41Apache Software Foundation Apache HTTP Server 2.0.41
cpe:/a:apache:http_server:2.0.36Apache Software Foundation Apache HTTP Server 2.0.36
cpe:/a:apache:http_server:2.0.40Apache Software Foundation Apache HTTP Server 2.0.40
cpe:/a:apache:http_server:2.0.37Apache Software Foundation Apache HTTP Server 2.0.37
cpe:/a:apache:http_server:2.0.42Apache Software Foundation Apache HTTP Server 2.0.42
cpe:/a:apache:http_server:2.0.35Apache Software Foundation Apache HTTP Server 2.0.35
cpe:/a:apache:http_server:2.0.45Apache Software Foundation Apache HTTP Server 2.0.45
cpe:/a:apache:http_server:2.0.50Apache Software Foundation Apache HTTP Server 2.0.50
cpe:/a:apache:http_server:2.0.43Apache Software Foundation Apache HTTP Server 2.0.43
cpe:/a:apache:http_server:2.0.39Apache Software Foundation Apache HTTP Server 2.0.39
cpe:/a:apache:http_server:2.0.44Apache Software Foundation Apache HTTP Server 2.0.44
cpe:/a:apache:http_server:2.0.46Apache Software Foundation Apache HTTP Server 2.0.46
cpe:/a:apache:http_server:2.0.32Apache Software Foundation Apache HTTP Server 2.0.32
cpe:/a:apache:http_server:2.0Apache Software Foundation Apache HTTP Server 2.0
cpe:/a:apache:http_server:2.0.38Apache Software Foundation Apache HTTP Server 2.0.38

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:11126mod_ssl in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (CPU consumption) by aborting an SSL connection in...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0748
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-0748
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200410-045
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/17200
(VENDOR_ADVISORY)  XF  apache-modssl-dos(17200)
http://www.redhat.com/support/errata/RHSA-2004-349.html
(VENDOR_ADVISORY)  REDHAT  RHSA-2004:349
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=130750
(UNKNOWN)  CONFIRM  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=130750
http://www.trustix.org/errata/2004/0047/
(UNKNOWN)  TRUSTIX  2004-0047
http://www.novell.com/linux/security/advisories/2004_30_apache2.html
(UNKNOWN)  SUSE  SUSE-SA:2004:030
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:096
(UNKNOWN)  MANDRAKE  MDKSA-2004:096
http://www.gentoo.org/security/en/glsa/glsa-200409-21.xml
(UNKNOWN)  GENTOO  GLSA-200409-21

- 漏洞信息

Apache Mod_SSL远程拒绝服务漏洞
中危 其他
2004-10-20 00:00:00 2005-10-20 00:00:00
远程  
        
        Mod_SSL是Apache服务器上的SSL实现,用来为Apache Web服务器提供加密支持。
        Apache Mod_SSL中包含一个输入过滤错误,远程攻击者可以利用这个漏洞对mod_ssl服务进行拒绝服务攻击。
        报告者使用第三方工具对使用mod_ssl服务的Apache进行测试,发现在ssl_io_input_getline()函数中存在一个漏洞。Apache在部分状态下没有关闭过滤器的SSL连接,相反是持续读取GETLINE/阻塞模式下的空闲请求。这样会导致ssl_io_input_getline()函数持续循环调用ssl_io_input_read(),造成消耗大量CPU资源,大量此类请求可导致服务停止响应,产生拒绝服务。
        

- 公告与补丁

        临时解决方法:
        如果您不能立刻安装补丁或者升级,CNNVD建议您采取以下措施以降低威胁:
        * 如下补丁实现在Apache CVS中:
        --- httpd-2.0/modules/ssl/ssl_engine_io.c 2004/07/13 18:11:22 1.124
        +++ httpd-2.0/modules/ssl/ssl_engine_io.c 2004/08/11 13:19:24 1.125
        @@ -589,6 +589,10 @@
        while (1) {
        if (!inctx->filter_ctx->pssl) {
        + /* Ensure a non-zero error code is returned */
        + if (inctx->rc == APR_SUCCESS) {
        + inctx->rc = APR_EGENERAL;
        + }
        break;
        }
        厂商补丁:
        RedHat
        ------
        RedHat已经为此发布了一个安全公告(RHSA-2004:349-01)以及相应补丁:
        RHSA-2004:349-01:Updated httpd packages fix mod_ssl security flaw
        链接:
        http://www.auscert.org.au/render.html?it=4356

        补丁下载:
        Red Hat Enterprise Linux AS version 3:
        SRPMS:
        ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/httpd-2.0.46-38.ent.src.rpm
        1988340a6e8be0c63b10c388b1243569 httpd-2.0.46-38.ent.src.rpm
        i386:
        a5b8f9a72302e14c0f410f7f83a39d32 httpd-2.0.46-38.ent.i386.rpm
        d8b74b3477300b5a4a156c59f5e0d4a5 httpd-devel-2.0.46-38.ent.i386.rpm
        8f734e5757c8c897cf71a6109af7d632 mod_ssl-2.0.46-38.ent.i386.rpm
        ia64:
        d5ac022099d9b76006e823a3f9c07c69 httpd-2.0.46-38.ent.ia64.rpm
        3a66d83595e19843fcf552fd07bcfe29 httpd-devel-2.0.46-38.ent.ia64.rpm
        3c4d1bfb5b407da142c515d32782ec02 mod_ssl-2.0.46-38.ent.ia64.rpm
        ppc:
        bc92043b213069bcf78aad0dffad74b4 httpd-2.0.46-38.ent.ppc.rpm
        b9156531a43492b3a5504375104fa473 httpd-devel-2.0.46-38.ent.ppc.rpm
        62593d85534ce48a38efa04fa7fa0b99 mod_ssl-2.0.46-38.ent.ppc.rpm
        s390:
        b8e7476c417c7eba2b46704fa446216c httpd-2.0.46-38.ent.s390.rpm
        30f45622c9de74914983c0a31f638c16 httpd-devel-2.0.46-38.ent.s390.rpm
        4d3abcba4b77
        可使用下列命令安装补丁:
        rpm -Fvh [文件名]
        Apache
        ------
        目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:
        Apache Software Foundation Upgrade httpd-2.0.51.tar.gz
        
        http://www.apache.org/dist/httpd/httpd-2.0.51.tar.gz

- 漏洞信息 (F34246)

RHSA-2004-349.txt (PacketStormID:F34246)
2004-09-09 00:00:00
 
advisory,remote
linux,redhat
CVE-2004-0748
[点击下载]

Red Hat Security Advisory RHSA-2004:349 - An input filter bug in mod_ssl was discovered in Apache httpd version 2.0.50 and earlier. A remote attacker could force an SSL connection to be aborted in a particular state and cause an Apache child process to enter an infinite loop, consuming CPU resources.

Updated httpd packages fix mod_ssl security flaw

Advisory: RHSA-2004:349-10
Last updated on: 2004-09-01
Affected Products: Red Hat Desktop (v. 3) <#Red Hat Desktop (v. 3)>
Red Hat Enterprise Linux AS (v. 3) <#Red Hat Enterprise Linux AS (v. 3)>
Red Hat Enterprise Linux ES (v. 3) <#Red Hat Enterprise Linux ES (v. 3)>
Red Hat Enterprise Linux WS (v. 3) <#Red Hat Enterprise Linux WS (v. 3)>
CVEs (cve.mitre.org <http://cve.mitre.org>): CAN-2004-0748



Security Advisory   Security Advisory


*Details:*

Updated httpd packages that include a security fix for mod_ssl and various
enhancements are now available.

The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.

An input filter bug in mod_ssl was discovered in Apache httpd version
2.0.50 and earlier. A remote attacker could force an SSL connection to be
aborted in a particular state and cause an Apache child process to enter an
infinite loop, consuming CPU resources. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0748 to
this issue.

Additionally, this update includes the following enhancements and bug fixes:

- included an improved version of the mod_cgi module that correctly handles
concurrent output on stderr and stdout

- included support for direct lookup of SSL variables using %{SSL:...}
from mod_rewrite, or using %{...}s from mod_headers

- restored support for use of SHA1-encoded passwords

- added the mod_ext_filter module

Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.


*Updated packages:*

*Red Hat Desktop (v. 3)*
------------------------------------------------------------------------
*AMD64:*
httpd-2.0.46-38.ent.x86_64.rpm     ed7ec8f521a72ceb98e339f7ee667aeb
httpd-devel-2.0.46-38.ent.x86_64.rpm     6d3bd873b963a3ff1c40bef74e7e7566
mod_ssl-2.0.46-38.ent.x86_64.rpm     c851e372161ce0262678158dd39d5191
 
*SRPMS:*
httpd-2.0.46-38.ent.src.rpm     1988340a6e8be0c63b10c388b1243569
 
*i386:*
httpd-2.0.46-38.ent.i386.rpm     a5b8f9a72302e14c0f410f7f83a39d32
httpd-devel-2.0.46-38.ent.i386.rpm     d8b74b3477300b5a4a156c59f5e0d4a5
mod_ssl-2.0.46-38.ent.i386.rpm     8f734e5757c8c897cf71a6109af7d632
 
*Red Hat Enterprise Linux AS (v. 3)*
------------------------------------------------------------------------
*AMD64:*
httpd-2.0.46-38.ent.x86_64.rpm     ed7ec8f521a72ceb98e339f7ee667aeb
httpd-devel-2.0.46-38.ent.x86_64.rpm     6d3bd873b963a3ff1c40bef74e7e7566
mod_ssl-2.0.46-38.ent.x86_64.rpm     c851e372161ce0262678158dd39d5191
 
*SRPMS:*
httpd-2.0.46-38.ent.src.rpm     1988340a6e8be0c63b10c388b1243569
 
*i386:*
httpd-2.0.46-38.ent.i386.rpm     a5b8f9a72302e14c0f410f7f83a39d32
httpd-devel-2.0.46-38.ent.i386.rpm     d8b74b3477300b5a4a156c59f5e0d4a5
mod_ssl-2.0.46-38.ent.i386.rpm     8f734e5757c8c897cf71a6109af7d632
 
*ia64:*
httpd-2.0.46-38.ent.ia64.rpm     d5ac022099d9b76006e823a3f9c07c69
httpd-devel-2.0.46-38.ent.ia64.rpm     3a66d83595e19843fcf552fd07bcfe29
mod_ssl-2.0.46-38.ent.ia64.rpm     3c4d1bfb5b407da142c515d32782ec02
 
*ppc:*
httpd-2.0.46-38.ent.ppc.rpm     bc92043b213069bcf78aad0dffad74b4
httpd-devel-2.0.46-38.ent.ppc.rpm     b9156531a43492b3a5504375104fa473
mod_ssl-2.0.46-38.ent.ppc.rpm     62593d85534ce48a38efa04fa7fa0b99
 
*s390:*
httpd-2.0.46-38.ent.s390.rpm     b8e7476c417c7eba2b46704fa446216c
httpd-devel-2.0.46-38.ent.s390.rpm     30f45622c9de74914983c0a31f638c16
mod_ssl-2.0.46-38.ent.s390.rpm     4d3abcba4b77985fcdb1ac78a844a5c4
 
*s390x:*
httpd-2.0.46-38.ent.s390x.rpm     27ad42b7d9018420c725338622dfef35
httpd-devel-2.0.46-38.ent.s390x.rpm     49511800564746aa927bf7f224f0598e
mod_ssl-2.0.46-38.ent.s390x.rpm     a22a2b21a0bdf04efec6ac07f2884ea9
 
*Red Hat Enterprise Linux ES (v. 3)*
------------------------------------------------------------------------
*AMD64:*
httpd-2.0.46-38.ent.x86_64.rpm     ed7ec8f521a72ceb98e339f7ee667aeb
httpd-devel-2.0.46-38.ent.x86_64.rpm     6d3bd873b963a3ff1c40bef74e7e7566
mod_ssl-2.0.46-38.ent.x86_64.rpm     c851e372161ce0262678158dd39d5191
 
*SRPMS:*
httpd-2.0.46-38.ent.src.rpm     1988340a6e8be0c63b10c388b1243569
 
*i386:*
httpd-2.0.46-38.ent.i386.rpm     a5b8f9a72302e14c0f410f7f83a39d32
httpd-devel-2.0.46-38.ent.i386.rpm     d8b74b3477300b5a4a156c59f5e0d4a5
mod_ssl-2.0.46-38.ent.i386.rpm     8f734e5757c8c897cf71a6109af7d632
 
*ia64:*
httpd-2.0.46-38.ent.ia64.rpm     d5ac022099d9b76006e823a3f9c07c69
httpd-devel-2.0.46-38.ent.ia64.rpm     3a66d83595e19843fcf552fd07bcfe29
mod_ssl-2.0.46-38.ent.ia64.rpm     3c4d1bfb5b407da142c515d32782ec02
 
*Red Hat Enterprise Linux WS (v. 3)*
------------------------------------------------------------------------
*AMD64:*
httpd-2.0.46-38.ent.x86_64.rpm     ed7ec8f521a72ceb98e339f7ee667aeb
httpd-devel-2.0.46-38.ent.x86_64.rpm     6d3bd873b963a3ff1c40bef74e7e7566
mod_ssl-2.0.46-38.ent.x86_64.rpm     c851e372161ce0262678158dd39d5191
 
*SRPMS:*
httpd-2.0.46-38.ent.src.rpm     1988340a6e8be0c63b10c388b1243569
 
*i386:*
httpd-2.0.46-38.ent.i386.rpm     a5b8f9a72302e14c0f410f7f83a39d32
httpd-devel-2.0.46-38.ent.i386.rpm     d8b74b3477300b5a4a156c59f5e0d4a5
mod_ssl-2.0.46-38.ent.i386.rpm     8f734e5757c8c897cf71a6109af7d632
 
*ia64:*
httpd-2.0.46-38.ent.ia64.rpm     d5ac022099d9b76006e823a3f9c07c69
httpd-devel-2.0.46-38.ent.ia64.rpm     3a66d83595e19843fcf552fd07bcfe29
mod_ssl-2.0.46-38.ent.ia64.rpm     3c4d1bfb5b407da142c515d32782ec02
 
(The unlinked packages above are only available from the Red Hat Network
</>)

*Solution*

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.


*Bugs fixed:*  (see bugzilla <http://bugzilla.redhat.com/bugzilla> for
more information)

112216 <http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=112216> -
4097+ bytes of stderr from cgi script causes script to hang
117959 <http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=117959> -
Apache autoindex corrupt when > 2GB file in tree
119651 <http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=119651> -
HTTP authentication against password file with SHA1 password hashes fails
120072 <http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120072> -
please enable mod_ext_filter
120096 <http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=120096> -
mod_ssl environment variables not available in mod_rewrite rules


*References:*

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0748
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=29964


*Keywords:*

httpd


------------------------------------------------------------------------
The listed packages are GPG signed by Red Hat, Inc. for security. Our
key is available at:
http://www.redhat.com/solutions/security/news/publickey/#key

You can verify each package and see who signed it with the following
command:

|rpm --checksig -v filename|

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:

|md5sum filename|

The Red Hat security contact is security@redhat.com. More contact details at
http://www.redhat.com/solutions/security/news/contact.html


    

- 漏洞信息

9523
Apache HTTP Server mod_ssl Aborted Connection DoS
Remote / Network Access Denial of Service
Loss of Availability
Exploit Unknown

- 漏洞描述

mod_ssl on Apache 2 contains a flaw that may allow a remote denial of service. The issue is triggered when an attacker forces an SSL connection to abort during a particular state causing the ssl_io_input_getline function to enter into an infinite loop, resulting in a loss of availability for the Apache server.

- 时间线

2004-07-07 Unknow
Unknow Unknow

- 解决方案

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: 1. Disable mod_ssl in your Apache configuration file. 2. Apply appropriate operating system vendor released upgrade. 3. An unstable patch is available.

- 相关参考

- 漏洞作者

- 漏洞信息

Apache mod_ssl Denial Of Service Vulnerability
Failure to Handle Exceptional Conditions 11094
Yes No
2004-09-02 12:00:00 2009-07-12 07:06:00
Francis Wai <fwai@rsasecurity.com> reported this vulnerability to the vendor.

- 受影响的程序版本

Turbolinux Turbolinux Server 10.0
Turbolinux Turbolinux Desktop 10.0
Turbolinux Home
Trustix Secure Linux 2.1
Trustix Secure Linux 2.0
Trustix Secure Enterprise Linux 2.0
Mandriva Linux Mandrake 10.0 AMD64
Mandriva Linux Mandrake 10.0
Mandriva Linux Mandrake 9.2 amd64
Mandriva Linux Mandrake 9.2
HP HP-UX B.11.23
HP HP-UX B.11.22
HP HP-UX B.11.11
HP HP-UX B.11.00
Gentoo Linux 1.4
Conectiva Linux 10.0
Conectiva Linux 9.0
Avaya S8700 R2.0.1
Avaya S8700 R2.0.0
Avaya S8500 R2.0.1
Avaya S8500 R2.0.0
Avaya S8300 R2.0.1
Avaya S8300 R2.0.0
Avaya Converged Communications Server 2.0
Apache Software Foundation Apache 2.0.50
+ Mandriva Linux Mandrake 10.1 x86_64
+ Mandriva Linux Mandrake 10.1
Apache Software Foundation Apache 2.0.49
+ S.u.S.E. Linux Personal 9.1
+ Trustix Secure Linux 2.1
+ Trustix Secure Linux 2.0
Apache Software Foundation Apache 2.0.48
+ Mandriva Linux Mandrake 10.0 AMD64
+ Mandriva Linux Mandrake 10.0
+ S.u.S.E. Linux 8.1
+ S.u.S.E. Linux Personal 9.0 x86_64
+ S.u.S.E. Linux Personal 9.0
+ S.u.S.E. Linux Personal 8.2
+ Trustix Secure Linux 2.1
+ Trustix Secure Linux 2.0
Apache Software Foundation Apache 2.0.47
+ Apple Mac OS X Server 10.3.5
+ Apple Mac OS X Server 10.3.4
+ Apple Mac OS X Server 10.3.3
+ Apple Mac OS X Server 10.3.2
+ Apple Mac OS X Server 10.3.1
+ Apple Mac OS X Server 10.3
+ Apple Mac OS X Server 10.2.8
+ Apple Mac OS X Server 10.2.7
+ Apple Mac OS X Server 10.2.6
+ Apple Mac OS X Server 10.2.5
+ Apple Mac OS X Server 10.2.4
+ Apple Mac OS X Server 10.2.3
+ Apple Mac OS X Server 10.2.2
+ Apple Mac OS X Server 10.2.1
+ Apple Mac OS X Server 10.2
+ Apple Mac OS X Server 10.1.5
+ Apple Mac OS X Server 10.1.4
+ Apple Mac OS X Server 10.1.3
+ Apple Mac OS X Server 10.1.2
+ Apple Mac OS X Server 10.1.1
+ Apple Mac OS X Server 10.1
+ Mandriva Linux Mandrake 9.2 amd64
+ Mandriva Linux Mandrake 9.2
+ Mandriva Linux Mandrake 9.1 ppc
+ Mandriva Linux Mandrake 9.1
Apache Software Foundation Apache 2.0.46
+ Red Hat Enterprise Linux AS 3
+ RedHat Desktop 3.0
+ RedHat Enterprise Linux ES 3
+ RedHat Enterprise Linux WS 3
+ Trustix Secure Linux 2.0
Apache Software Foundation Apache 2.0.45
- Apple Mac OS X 10.2.6
- Apple Mac OS X 10.2.5
- Apple Mac OS X 10.2.4
- Apple Mac OS X 10.2.3
- Apple Mac OS X 10.2.2
- Apple Mac OS X 10.2.1
- Apple Mac OS X 10.2
- Apple Mac OS X 10.1.5
- Apple Mac OS X 10.1.4
- Apple Mac OS X 10.1.3
- Apple Mac OS X 10.1.2
- Apple Mac OS X 10.1.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.1
- Apple Mac OS X 10.0.4
- Apple Mac OS X 10.0.3
- Apple Mac OS X 10.0.2
- Apple Mac OS X 10.0.1
- Apple Mac OS X 10.0
+ Conectiva Linux 9.0
Apache Software Foundation Apache 2.0.44
Apache Software Foundation Apache 2.0.43
Apache Software Foundation Apache 2.0.42
+ Gentoo Linux 1.4 _rc1
+ Gentoo Linux 1.2
Apache Software Foundation Apache 2.0.41
Apache Software Foundation Apache 2.0.40
+ RedHat Linux 9.0 i386
+ RedHat Linux 8.0
+ Terra Soft Solutions Yellow Dog Linux 3.0
Apache Software Foundation Apache 2.0.39
Apache Software Foundation Apache 2.0.38
Apache Software Foundation Apache 2.0.37
Apache Software Foundation Apache 2.0.36
Apache Software Foundation Apache 2.0.35
Apache Software Foundation Apache 2.0.32
Apache Software Foundation Apache 2.0.28 Beta
Apache Software Foundation Apache 2.0.28
Apache Software Foundation Apache 2.0 a9
Apache Software Foundation Apache 2.0
Apache Software Foundation Apache 2.0.51
+ Red Hat Fedora Core2
+ Red Hat Fedora Core1

- 不受影响的程序版本

Apache Software Foundation Apache 2.0.51
+ Red Hat Fedora Core2
+ Red Hat Fedora Core1

- 漏洞讨论

Apache mod_ssl is reported susceptible to a denial of service vulnerability.

This issue presents itself during SSL connections to a vulnerable Apache server. The affected software may enter into an infinite loop in certain circumstances. This will consume CPU resources and potentially cause further connections to the affected server to fail.


All Apache versions from 2.0 through to 2.0.50 are reported vulnerable.

Update: Avaya has released an advisory identifying Avaya S8700/S8500/S8300 running CM 2.0 and later, and all versions of Avaya Converged Communication Server as vulnerable to this issue.

- 漏洞利用

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com &lt;mailto:vuldb@securityfocus.com&gt;.

- 解决方案

Turbolinux has released advisory TLSA-2005-01-13 along with fixes dealing with this and other issues. Please see the referenced advisory for more information.

RedHat has released advisory RHSA-2004:349-10 addressing this, and other issues. Please see the referenced advisory for further information on obtaining fixes.

SuSE has released advisory SUSE-SA:2004:030 and fixes that eliminate this vulnerability. Please see the referenced advisory.

Mandrake Linux has released an advisory (MDKSA-2004:096) along with fixes dealing with this issue. Please see the referenced advisory for more information.

Trustix Secure Linux has released an advisory (TSLSA-2004-0047) along with fixes dealing with this, and other issues. Please see the referenced advisory for further information.

Gentoo Linux has released advisory GLSA 200409-21 to address this, and other issues. Please see the referenced advisory for further information. Users of affected packages are urged to execute the following with superuser privileges:
emerge sync
emerge -pv ">=net-www/apache-2.0.51"
emerge ">=net-www/apache-2.0.51"
emerge -pv ">=net-www/mod_dav-1.0.3-r2"
emerge ">=net-www/mod_dav-1.0.3-r2"

Conectiva Linux has released advisory CLA-2004:868 along with fixes to address this, and other issues. Please see the referenced advisory for further information.

Red Hat Fedora has released an advisory (FEDORA-2004-313) along with fixes dealing with this and other issues. Please see the referenced advisory for more information.

Apache has released version 2.0.51 to address this, and other issues:

HP has released an advisory (HPSBUX01090) to address various issues affecting HP-UX running Apache and PHP. Please see the referenced advisory for more information.

Apple has released an advisory (APPLE-SA-2004-12-02) dealing with this and other issues. Please see the referenced advisory for more information.


Apache Software Foundation Apache 2.0

Apache Software Foundation Apache 2.0 a9

Apache Software Foundation Apache 2.0.28

Apache Software Foundation Apache 2.0.28 Beta

Apache Software Foundation Apache 2.0.32

Apache Software Foundation Apache 2.0.35

Apache Software Foundation Apache 2.0.36

Apache Software Foundation Apache 2.0.37

Apache Software Foundation Apache 2.0.38

Apache Software Foundation Apache 2.0.39

Apache Software Foundation Apache 2.0.40

Apache Software Foundation Apache 2.0.41

Apache Software Foundation Apache 2.0.42

Apache Software Foundation Apache 2.0.43

Apache Software Foundation Apache 2.0.44

Apache Software Foundation Apache 2.0.45

Apache Software Foundation Apache 2.0.46

Apache Software Foundation Apache 2.0.47

Apache Software Foundation Apache 2.0.48

Apache Software Foundation Apache 2.0.49

Apache Software Foundation Apache 2.0.50

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站