The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.
A stack buffer overflow was discovered in mod_ssl that could be triggered
if using the FakeBasicAuth option. If mod_ssl was sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow
occured if FakeBasicAuth had been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have had to be signed by
a Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.
Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | any | ia64 | mod_ssl | < 2.0.46-32.ent.3 | mod_ssl-2.0.46-32.ent.3.ia64.rpm |
RedHat | any | ia64 | httpd | < 2.0.46-32.ent.3 | httpd-2.0.46-32.ent.3.ia64.rpm |
RedHat | any | ia64 | httpd-devel | < 2.0.46-32.ent.3 | httpd-devel-2.0.46-32.ent.3.ia64.rpm |