National Cyber-Alert System

Vulnerability Summary for CVE-2003-0245

Overview

Vulnerability in the apr_psprintf function in the Apache Portable Runtime (APR) library for Apache 2.0.37 through 2.0.45 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via long strings, as demonstrated using XML objects to mod_dav, and possibly other vectors.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.0.46: http://httpd.apache.org/security/vulnerabilities_20.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#757612

Name: VU#757612

Type: Advisory

Hyperlink:http://www.kb.cert.org/vuls/id/757612

External Source: REDHAT

Name: RHSA-2003:186

Type: Advisory; Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-186.html

External Source: CONFIRM

Name: http://www.apache.org/dist/httpd/Announcement2.html

Type: Advisory; Patch Information

Hyperlink:http://www.apache.org/dist/httpd/Announcement2.html

External Source: BUGTRAQ

Name: 20030528 [SECURITY] [ANNOUNCE] Apache 2.0.46 released

Type: Advisory; Patch Information

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=105418115512559&w=2

External Source: XF

Name: apache-aprpsprintf-code-execution(12090)

Hyperlink:http://xforce.iss.net/xforce/xfdb/12090

External Source: BID

Name: 7723

Hyperlink:http://www.securityfocus.com/bid/7723

External Source: MISC

Name: http://www.idefense.com/advisory/05.30.03.txt

Hyperlink:http://www.idefense.com/advisory/05.30.03.txt

External Source: VULNWATCH

Name: 20030530 iDEFENSE Security Advisory 05.30.03: Apache Portable Runtime Denial of Service and Arbitrary Code Execution Vulnerability

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2003-q2/0095.html

External Source: MANDRAKE

Name: MDKSA-2003:063

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2003:063

External Source: CONECTIVA

Name: CLA-2003:661

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000661