The prefork MPM in Apache 2 before 2.0.47 does not properly handle certain errors from accept, which could lead to a denial of service.

The remote host appears to be running a version of Apache 2.x prior to 2.0.47. It is, therefore, affected by multiple vulnerabilities :

  - An issue in may occur when the SSLCipherSuite directive     is used to upgrade a cipher suite which could lead to a     weaker cipher suite being used instead of the upgraded     one. (CVE-2003-0192)

  - A denial of service vulnerability may exist in the FTP     proxy component relating to the use of IPV6 addresses.
    (CVE-2003-0253)

  - An attacker may be able to craft a type-map file that     could cause the server to enter an infinite loop.
    (CVE-2003-0254)

Several vulnerabilities were discovered in Apache 2.x versions prior to 2.0.47. From the Apache 2.0.47 release notes :

Certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the new one (CVE-2003-0192).

Certain errors returned by accept() on rarely accessed ports could cause temporary Denial of Service due to a bug in the prefork MPM (CVE-2003-0253).

Denial of Service was caused when target host is IPv6 but FTP proxy server can't create IPv6 socket (CVE-2003-0254).

The server would crash when going into an infinite loop due to too many subsequent internal redirects and nested subrequests (VU#379828).

The Apache Software Foundation thanks Saheed Akhtar and Yoshioka Tsuneo for responsibly reporting these issues.

To upgrade these apache packages, first stop Apache by issuing, as root :

service httpd stop

After the upgrade, restart Apache with :

service httpd start

Update :

The previously released packages had a manpage conflict between apache2-common and apache-1.3 that prevented both packages from being installed at the same time. This update provides a fixed apache2-common package.

ID	Name	Product	Family	Type	Severity
11788	Apache 2.0.x < 2.0.47 Multiple Vulnerabilities (DoS, Encryption)	Nessus	Web Servers	Remote	medium
14058	Mandrake Linux Security Advisory : apache2 (MDKSA-2003:075-1)	Nessus	Mandriva Local Security Checks	Local	medium

Detections

Analytics

CVE-2003-0253

high

Tenable Plugins

medium

medium