mod_ssl Off-by-One Vulnerability

vendor:

HTTP Server

by:

SecurityFocus

7,5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: HTTP Server

Affected Version From: Apache 1.3.20

Affected Version To: Apache 1.3.26

Patch Exists: YES

Related CWE: CVE-2002-0082

CPE: a:apache:http_server

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2003-168/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2002

mod_ssl Off-by-One Vulnerability

An off-by-one issue exists in mod_ssl that affects Apache when handling certain types of long entries in an .htaccess file. A .htaccess file with 10000 or more bytes set into the variable DATE_LOCALE will result in a buffer overflow within the web server process handling the request.

Mitigation:

Disable the AllowOverride configuration variable in Apache.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5084/info

An off-by-one issue exists in mod_ssl that affects Apache when handling certain types of long entries in an .htaccess file. Though this capability within the web server is not enabled by default, it is popular as it allows non-privileged users to create web access control schemes for hosted sites, and is enabled through the "AllowOverride" configuration variable in Apache. A .htaccess file with 10000 or more bytes set into the variable DATE_LOCALE will result in a buffer overflow within the web server process handling the request.

In a regular .htaccess file:

SetEnv DATE_LOCALE "X"

where the character X represents a string of 12288 bytes.