National Cyber-Alert System

Vulnerability Summary for CVE-2002-0839

Overview

The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Apache (07/02/2008)

Fixed in Apache HTTP Server 1.3.27: http://httpd.apache.org/security/vulnerabilities_13.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VULNWATCH

Name: 20021003 iDEFENSE Security Advisory 10.03.2002: Apache 1.3.x shared memory scoreboard vulnerabilities

Type: Advisory; Patch Information

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0012.html

External Source: BID

Name: 5884

Hyperlink:http://www.securityfocus.com/bid/5884

External Source: ENGARDE

Name: ESA-20021007-024

Hyperlink:http://www.linuxsecurity.com/advisories/other_advisory-2414.html

External Source: MANDRAKE

Name: MDKSA-2002:068

Hyperlink:http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-068.php

External Source: XF

Name: apache-scorecard-memory-overwrite(10280)

Type: Advisory

Hyperlink:http://www.iss.net/security_center/static/10280.php

External Source: DEBIAN

Name: DSA-195

Hyperlink:http://www.debian.org/security/2002/dsa-195

External Source: DEBIAN

Name: DSA-188

Hyperlink:http://www.debian.org/security/2002/dsa-188

External Source: DEBIAN

Name: DSA-187

Hyperlink:http://www.debian.org/security/2002/dsa-187

External Source: CONFIRM

Name: http://www.apacheweek.com/issues/02-10-04

Type: Advisory

Hyperlink:http://www.apacheweek.com/issues/02-10-04

External Source: HP

Name: HPSBUX0210-224

Hyperlink:http://online.securityfocus.com/advisories/4617

External Source: BUGTRAQ

Name: 20021017 TSLSA-2002-0069-apache

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html

External Source: BUGTRAQ

Name: 20021015 GLSA: apache

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2002-10/0195.html

External Source: SGI

Name: 20021105-01-I

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20021105-01-I

External Source: BUGTRAQ

Name: 20021003 [OpenPKG-SA-2002.009] OpenPKG Security Advisory (apache)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=103376585508776&w=2

External Source: CONFIRM

Name: http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=103367938230488&w=2

Hyperlink:http://marc.theaimsgroup.com/?l=apache-httpd-announce&m=103367938230488&w=2

External Source: CONECTIVA

Name: CLA-2002:530

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000530