Vulnerability CVE-2004-0700
Published: 2004-07-27   Modified: 2012-02-12

Description:
Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Mod ssl -> Mod ssl 
Gentoo -> Linux 

 References:
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000857
http://marc.info/?l=apache-modssl&m=109001100906749&w=2
http://marc.info/?l=bugtraq&m=109005001205991&w=2
http://packetstormsecurity.org/0407-advisories/modsslFormat.txt
http://virulent.siyahsapka.org/
http://www.debian.org/security/2004/dsa-532
http://www.kb.cert.org/vuls/id/303448
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:075
http://www.redhat.com/support/errata/RHSA-2004-405.html
http://www.redhat.com/support/errata/RHSA-2004-408.html
http://www.securityfocus.com/bid/10736
http://www.ubuntu.com/usn/usn-177-1
http://xforce.iss.net/xforce/xfdb/16705
https://bugzilla.fedora.us/show_bug.cgi?id=1888
Copyright 2024, cxsecurity.com

 

Back to Top