Vulnerability CVE-2010-0010
Published: 2010-02-02   Modified: 2012-02-13

Description:
Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.

See advisories in our WLB2 database:
Topic
Author
Date
High
Apache 1.3.41 mod_proxy Integer overflow (code execution)
Adam Zabrocki
29.01.2010

Type:

CWE-189

 (Numeric Errors)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Apache -> Http server 

 References:
http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0589.html
http://blog.pi3.com.pl/?p=69
http://httpd.apache.org/dev/dist/CHANGES_1.3.42
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
http://marc.info/?l=bugtraq&m=130497311408250&w=2
http://packetstormsecurity.org/1001-exploits/modproxy-overflow.txt
http://site.pi3.com.pl/adv/mod_proxy.txt
http://www.securityfocus.com/archive/1/509185/100/0/threaded
http://www.securityfocus.com/bid/37966
http://www.securitytracker.com/id?1023533
http://www.vupen.com/english/advisories/2010/0240
http://www.vupen.com/english/advisories/2010/1001
https://exchange.xforce.ibmcloud.com/vulnerabilities/55941
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7923
Copyright 2024, cxsecurity.com

 

Back to Top