CVE-2004-0493

UNRATED

ExploitHigh EPSS

Description

The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.

Affected products

apache / http_server2.0.48 – 2.0.48
apache / http_server2.0.49 – 2.0.49
apache / http_server2.0.47 – 2.0.47
Avaya / converged_communications_server2.0 – 2.0
Avaya / s8300r2.0.0 – r2.0.0
Avaya / s8500r2.0.0 – r2.0.0
Avaya / s8700r2.0.0 – r2.0.0
gentoo / linux1.4 – 1.4
ibm / http_server2.0.42 – 2.0.42
ibm / http_server2.0.42.1 – 2.0.42.1
ibm / http_server2.0.42.2 – 2.0.42.2
ibm / http_server2.0.47.1 – 2.0.47.1
ibm / http_server2.0.47 – 2.0.47
trustix / secure_linux2.0 – 2.0
trustix / secure_linux1.5 – 1.5
trustix / secure_linux2.1 – 2.1

Exploits & proofs of concept

exploit-dbApache - Arbitrary Long HTTP Headers Denial of Serviceby anonymous
exploit-dbApache - Arbitrary Long HTTP Headers (Denial of Service)by bkbll

References

Updated 18m ago · 8 sources