apache: buffer overflows in mod_alias, mod

Package(s):

apache

CVE #(s):

CAN-2003-0542 CAN-2003-0789

Created:

October 28, 2003

Updated:

February 13, 2004

Description:

André Malo discovered buffer overflows in the mod_alias and mod_rewrite modules of the Apache webserver. These occurred if a regular expression with more than 9 capturing parenthesis was configured. To exploit this, an attacker would need to be able to locally create a carefully crafted configuration file (.htaccess or httpd.conf). CAN-2003-0542

Another buffer overflow in Apache 2.0.47 and earlier in mod_cgid's mishandling of CGI redirect paths could result in CGI output going to the wrong client when a threaded MPM is used. CAN-2003-0789.

Alerts:

Whitebox	WBSA-2004:015-01	2004-02-12
Fedora	FEDORA-2003-004	2004-01-08
Red Hat	RHSA-2003:405-00	2003-12-18
Red Hat	RHSA-2003:320-01	2003-12-16
Red Hat	RHSA-2003:360-01	2003-12-10
Gentoo	200310-03	2003-10-28
Trustix	2003-0041	2003-11-15
Conectiva	CLA-2003:775	2003-11-05
Slackware	SSA:2003-308-01	2003-11-03
EnGarde	ESA-20031105-030	2003-11-05
Mandrake	MDKSA-2003:103	2003-11-03
Gentoo	200310-04	2003-10-31
Immunix	IMNX-2003-7+-025-01	2003-10-28
OpenPKG	OpenPKG-SA-2003.046	2003-10-28

(Log in to post comments)

apache: buffer overflows in mod_alias, mod_rewrite