Rapid7 Vulnerability & Exploit Database

CESA-2002:126: apache security update

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

CESA-2002:126: apache security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
07/03/2002
Created
07/25/2018
Added
03/12/2010
Modified
07/04/2017

Description

The Apache Web server contains a security vulnerability which can be used to launch a denial of service (DoS) attack or, in some cases, allow remote code execution.

Versions of the Apache Web server up to and including 1.3.24 contain a bug in the routines which deal with requests using "chunked" encoding. A carefully crafted invalid request can cause an Apache child process to call the memcpy() function in a way that will write past the end of its buffer, corrupting the stack. On some platforms this can be remotely exploited -- allowing arbitrary code to be run on the server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0392 to this issue. All users of Apache should update to these errata packages to correct this security issue.

Solution(s)

  • centos-upgrade-apache
  • centos-upgrade-apache-devel
  • centos-upgrade-apache-manual

References

  • https://attackerkb.com/topics/cve-2002-0392
  • 20005
  • 5033
  • CSSA-2002-029.0
  • CSSA-2002-SCO.31
  • CSSA-2002-SCO.32
  • CESA-2002:126
  • CA-2002-17
  • 944335
  • CLSA-2002:498
  • CVE - 2002-0392
  • DSA-131
  • DSA-132
  • DSA-133
  • MDKSA-2002:039
  • 838
  • RHSA-2002:103
  • RHSA-2002:117
  • RHSA-2002:118
  • RHSA-2002:126
  • RHSA-2002:150
  • RHSA-2003:106
  • 20020605-01-A
  • 20020605-01-I
  • SuSE-SA:2002:022
  • 9249
View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;