vendor:
Apache HTTP Server
by:
GOBBLES Security
7.5
CVSS
HIGH
Buffer Overrun
120
CWE
Product Name: Apache HTTP Server
Affected Version From: Apache 1.3.22-24 and 1.3.20
Affected Version To: Apache 1.3.25
Patch Exists: YES
Related CWE: N/A
CPE: apache:http_server
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: FreeBSD 4.5, NetBSD
2002
Apache Chunked Encoding Buffer Overrun Vulnerability
When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper (signed) interpretation of an unsigned integer value. Consequently, several conditions that have security implications may occur. Reportedly, a buffer overrun and signal race condition occur. Exploiting these conditions may allow arbitrary code to run.
Mitigation:
Upgrade to Apache version 1.3.26 or later.