National Cyber-Alert System

Vulnerability Summary for CVE-2004-0700

Overview

Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#303448

Name: VU#303448

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/303448

External Source: XF

Name: apache-modssl-format-string(16705)

Type: Advisory; Patch Information

Hyperlink:http://xforce.iss.net/xforce/xfdb/16705

External Source: FEDORA

Name: FLSA:1888

Hyperlink:https://bugzilla.fedora.us/show_bug.cgi?id=1888

External Source: BID

Name: 10736

Hyperlink:http://www.securityfocus.com/bid/10736

External Source: REDHAT

Name: RHSA-2004:408

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-408.html

External Source: REDHAT

Name: RHSA-2004:405

Hyperlink:http://www.redhat.com/support/errata/RHSA-2004-405.html

External Source: OSVDB

Name: 7929

Hyperlink:http://www.osvdb.org/7929

External Source: MANDRAKE

Name: MDKSA-2004:075

Hyperlink:http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:075

External Source: DEBIAN

Name: DSA-532

Hyperlink:http://www.debian.org/security/2004/dsa-532

External Source: MISC

Name: http://virulent.siyahsapka.org/

Hyperlink:http://virulent.siyahsapka.org/

External Source: MISC

Name: http://packetstormsecurity.org/0407-advisories/modsslFormat.txt

Hyperlink:http://packetstormsecurity.org/0407-advisories/modsslFormat.txt

External Source: MLIST

Name: [apache-modssl] 20040716 [ANNOUNCE] mod_ssl 2.8.19 for Apache 1.3.31

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=apache-modssl&m=109001100906749&w=2

External Source: UBUNTU

Name: USN-177-1

Hyperlink:http://www.ubuntu.com/usn/usn-177-1

External Source: BUGTRAQ

Name: 20040716 [OpenPKG-SA-2004.032] OpenPKG Security Advisory (apache)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=109005001205991&w=2

External Source: CONECTIVA

Name: CLA-2004:857

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000857