National Cyber-Alert System

Vulnerability Summary for CVE-2002-0392

Overview

Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 2.0.37 and 1.3.26: http://httpd.apache.org/security/vulnerabilities_20.html http://httpd.apache.org/security/vulnerabilities_13.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

CERT/CC Advisory: CA-2002-17

Name: CA-2002-17

Type: Advisory; Patch Information

Hyperlink:http://www.cert.org/advisories/CA-2002-17.html

US-CERT Vulnerability Note: VU#944335

Name: VU#944335

Hyperlink:http://www.kb.cert.org/vuls/id/944335

External Source: CONFIRM

Name: http://httpd.apache.org/info/security_bulletin_20020617.txt

Type: Advisory

Hyperlink:http://httpd.apache.org/info/security_bulletin_20020617.txt

External Source: HP

Name: SSRT050968

Hyperlink:http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000083816475

External Source: BID

Name: 5033

Hyperlink:http://www.securityfocus.com/bid/5033

External Source: BID

Name: 20005

Hyperlink:http://www.securityfocus.com/bid/20005

External Source: REDHAT

Name: RHSA-2003:106

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-106.html

External Source: REDHAT

Name: RHSA-2002:150

Hyperlink:http://www.redhat.com/support/errata/RHSA-2002-150.html

External Source: REDHAT

Name: RHSA-2002:126

Hyperlink:http://www.redhat.com/support/errata/RHSA-2002-126.html

External Source: OSVDB

Name: 838

Hyperlink:http://www.osvdb.org/838

External Source: SUSE

Name: SuSE-SA:2002:022

Hyperlink:http://www.novell.com/linux/security/advisories/2002_22_apache.html

External Source: ENGARDE

Name: ESA-20020619-014

Hyperlink:http://www.linuxsecurity.com/advisories/other_advisory-2137.html

External Source: XF

Name: apache-chunked-encoding-bo(9249)

Hyperlink:http://www.iss.net/security_center/static/9249.php

External Source: FRSIRT

Name: ADV-2006-3598

Hyperlink:http://www.frsirt.com/english/advisories/2006/3598

External Source: DEBIAN

Name: DSA-133

Hyperlink:http://www.debian.org/security/2002/dsa-133

External Source: DEBIAN

Name: DSA-132

Hyperlink:http://www.debian.org/security/2002/dsa-132

External Source: DEBIAN

Name: DSA-131

Hyperlink:http://www.debian.org/security/2002/dsa-131

External Source: SECUNIA

Name: 21917

Hyperlink:http://secunia.com/advisories/21917

External Source: REDHAT

Name: RHSA-2002:118

Hyperlink:http://rhn.redhat.com/errata/RHSA-2002-118.html

External Source: REDHAT

Name: RHSA-2002:117

Hyperlink:http://rhn.redhat.com/errata/RHSA-2002-117.html

External Source: REDHAT

Name: RHSA-2002:103

Hyperlink:http://rhn.redhat.com/errata/RHSA-2002-103.html

External Source: BUGTRAQ

Name: 20020621 [SECURITY] Remote exploit for 32-bit Apache HTTP Server known

Hyperlink:http://online.securityfocus.com/archive/1/278149

External Source: HP

Name: HPSBUX0207-197

Hyperlink:http://online.securityfocus.com/advisories/4257

External Source: HP

Name: HPSBTL0206-049

Hyperlink:http://online.securityfocus.com/advisories/4240

External Source: MANDRAKE

Name: MDKSA-2002:039

Hyperlink:http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:039

External Source: CONECTIVA

Name: CLSA-2002:498

Hyperlink:http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000498

External Source: BUGTRAQ

Name: 20020621 [slackware-security] new apache/mod_ssl packages available

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2002-06/0266.html

External Source: BUGTRAQ

Name: 20020619 [OpenPKG-SA-2002.004] OpenPKG Security Advisory (apache)

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2002-06/0235.html

External Source: SGI

Name: 20020605-01-I

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20020605-01-I

External Source: SGI

Name: 20020605-01-A

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20020605-01-A

External Source: CALDERA

Name: CSSA-2002-SCO.31

Hyperlink:ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31

External Source: CALDERA

Name: CSSA-2002-SCO.32

Hyperlink:ftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32

External Source: CALDERA

Name: CSSA-2002-029.0

Hyperlink:ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txt