Memory leak in ssl_engine_io.c for mod_ssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.

Joe Orton reports a memory leak in Apache 2's mod_ssl. A remote attacker may issue HTTP requests on an HTTPS port, causing an error.
Due to a bug in processing this condition, memory associated with the connection is not freed. Repeated requests can result in consuming all available memory resources, probably resulting in termination of the Apache process.

s700_800 11.04 Webproxy server 2.0 update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Webproxy server 2.1 update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.5 OWS update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - Two potential security vulnerabilities have been     identified in OpenSSL by NISCC (224012/1 and 224012/2).
    The Common Vulnerabilities and Exposures project has     referenced them as the following CAN-2004-0079, and     CAN-2004-0112. The CERT summary is TA04-078A. 1. The     do_change_cipher_spec function in OpenSSL allows remote     attackers to cause a denial of service via a crafted     SSL/TLS handshake that triggers a null dereference.
    CVE-2004-0079 2. The SSL/TLS handshaking, when using     Kerberos ciphersuites, does not properly check the     length of Kerberos tickets during a handshake, which     allows remote attackers to cause a denial of service via     a crafted SSL/TLS handshake that causes an out-of-bounds     read. CVE-2004-0112. (HPSBUX01019 SSRT4717)

  - A potential security vulnerability has been identified     with Apache running on HP-UX where a buffer overflow     could be exploited remotely to execute arbitrary code.

  - A potential security vulnerability has been identified     with HP-UX running Apache where the vulnerability could     be exploited remotely to create a Denial of Service     (DoS) or to execute arbitrary code.

  - A potential security vulnerability has been identified     with Apache running on HP-UX where the vulnerability     could be exploited remotely to create a Denial of     Service (DoS) or to bypass access restrictions.

s700_800 11.04 Virtualvault 4.6 TGP update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.6 OWS update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.6 OpenSSH update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.6 IWS update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.7 TGP update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.7 OWS update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.7 OpenSSH update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.7 IWS update : 

Two potential security vulnerabilities have been identified in OpenSSL by NISCC (224012/1 and 224012/2). The Common Vulnerabilities and Exposures project has referenced them as the following CAN-2004-0079, and CAN-2004-0112. The CERT summary is TA04-078A. 1. The do_change_cipher_spec function in OpenSSL allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that triggers a null dereference. CVE-2004-0079 2. The SSL/TLS handshaking, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service via a crafted SSL/TLS handshake that causes an out-of-bounds read. CVE-2004-0112.

s700_800 11.04 Virtualvault 4.5 IWS Update : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with Apache running on HP-UX where the vulnerability     could be exploited remotely to create a Denial of     Service (DoS) or to bypass access restrictions.

  - A potential security vulnerability has been identified     with HP-UX running Apache where the vulnerability could     be exploited remotely to create a Denial of Service     (DoS) or to execute arbitrary code.

  - A potential security vulnerability has been identified     with Apache running on HP-UX where a buffer overflow     could be exploited remotely to execute arbitrary code.

  - Two potential security vulnerabilities have been     identified in OpenSSL by NISCC (224012/1 and 224012/2).
    The Common Vulnerabilities and Exposures project has     referenced them as the following CAN-2004-0079, and     CAN-2004-0112. The CERT summary is TA04-078A. 1. The     do_change_cipher_spec function in OpenSSL allows remote     attackers to cause a denial of service via a crafted     SSL/TLS handshake that triggers a null dereference.
    CVE-2004-0079 2. The SSL/TLS handshaking, when using     Kerberos ciphersuites, does not properly check the     length of Kerberos tickets during a handshake, which     allows remote attackers to cause a denial of service via     a crafted SSL/TLS handshake that causes an out-of-bounds     read. CVE-2004-0112. (HPSBUX01019 SSRT4717)

The remote host is affected by the vulnerability described in GLSA-200403-04 (Multiple security vulnerabilities in Apache 2)

    Three vulnerabilities were found:
    A memory leak in ssl_engine_io.c for mod_ssl in Apache 2.0.48 and below     allows remote attackers to cause a denial of service attack via plain     HTTP requests to the SSL port of an SSL-enabled server.
    Apache fails to filter terminal escape sequences from error logs that     begin with the ASCII (0x1B) sequence and are followed by a  series of     arguments. If a remote attacker could inject escape sequences into an     Apache error log, the attacker could take advantages of weaknesses in     various terminal emulators, launching attacks against remote users     including further denial of service attacks, file modification, and the     execution of arbitrary commands.
    The Apache mod_disk_cache has been found to be vulnerable to a weakness     that allows attackers to gain access to authentication credentials     through the issue of caching HTTP hop-by-hop headers which would     contain plaintext user passwords. There is no available resolution for     this issue yet.
  Impact :

    No special privileges are required for these vulnerabilities. As a     result, all users are recommended to upgrade their Apache     installations.
  Workaround :

    There is no immediate workaround; a software upgrade is required. There     is no workaround for the mod_disk_cache issue; users are recommended to     disable the feature on their servers until a patched version is     released.

The remote host appears to be running a version of Apache 2.x which is older than 2.0.49.  There is a bug in the mod_ssl module that ships with Apache 2.0.35 to 2.0.48 that makes it vulnerable to a remote denial of service.  An attacker may exploit this flaw by issuing malformed SSL commands when connecting to the remote host, and may therefore use it to prevent HTTPS from working. 

A memory leak in mod_ssl in the Apache HTTP Server prior to version 2.0.49 allows a remote denial of service attack against an SSL-enabled server.

The updated packages provide a patched mod_ssl to correct these problems.

The remote host is missing Security Update 2004-05-03.
This security update includes updates for AFP Server, CoreFoundation, and IPSec.

It also includes Security Update 2004-04-05, which includes updates for CUPS, libxml2, Mail, and OpenSSL.

For Mac OS X 10.2.8, it also includes updates for Apache 1.3, cd9660.util, Classic, CUPS, Directory Services, DiskArbitration, fetchmail, fs_usage, gm4, groff, Mail, OpenSSL, Personal File Sharing, PPP, rsync, Safari, System Configuration, System Initialization, and zlib.

This update fixes various issues which may allow an attacker to execute arbitrary code on the remote host.

Updated httpd packages are now available that fix a denial of service vulnerability in mod_ssl and include various other bug fixes.

The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server.

A memory leak in mod_ssl in the Apache HTTP Server prior to version 2.0.49 allows a remote denial of service attack against an SSL-enabled server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0113 to this issue.

This update also includes various bug fixes, including :

  - improvements to the mod_expires, mod_dav, mod_ssl and     mod_proxy modules

  - a fix for a bug causing core dumps during configuration     parsing on the IA64 platform

  - an updated version of mod_include fixing several edge     cases in the SSI parser

Additionally, the mod_logio module is now included.

Users of the Apache HTTP server should upgrade to these updated packages, which contain backported patches that address these issues.

The remote host appears to be running a version of Apache 2.0.x prior to 2.0.49. It is, therefore, affected by a denial of service vulnerability in the 'mod_ssl' module. An attacker can exploit this to deny service to the Apache server.

The remote host appears to be running a version of Apache 2.x which is older than 2.0.49.  There is a bug in the mod_ssl module that ships with Apache 2.0.35 to 2.0.48 that makes it vulnerable to a remote denial of service.  An attacker may exploit this flaw by issuing malformed SSL commands when connecting to the remote host, and may therefore use it to prevent HTTPS from working.

ID	Name	Product	Family	Severity
36300	FreeBSD : Apache 2 mod_ssl denial-of-service (492f8896-70fa-11d8-873f-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	medium
17534	HP-UX PHSS_30650 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17533	HP-UX PHSS_30649 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17532	HP-UX PHSS_30648 : s700_800 11.04 Virtualvault 4.5 OWS update	Nessus	HP-UX Local Security Checks	medium
17531	HP-UX PHSS_30646 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17530	HP-UX PHSS_30645 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17529	HP-UX PHSS_30644 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17528	HP-UX PHSS_30643 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17527	HP-UX PHSS_30642 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17526	HP-UX PHSS_30641 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17525	HP-UX PHSS_30640 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17071	HP-UX PHSS_30639 : HP-UX Running Apache, Remote Denial of Service (DoS) (HPSBUX01019 SSRT4717 rev.3)	Nessus	HP-UX Local Security Checks	medium
17070	HP-UX PHSS_30647 : s700_800 11.04 Virtualvault 4.5 IWS Update	Nessus	HP-UX Local Security Checks	medium
14455	GLSA-200403-04 : Multiple security vulnerabilities in Apache 2	Nessus	Gentoo Local Security Checks	medium
1205	Apache HTTP Server < 2.0.49 mod_ssl Plain HTTP Request DoS	Nessus Network Monitor	Web Servers	high
14142	Mandrake Linux Security Advisory : apache2 (MDKSA-2004:043)	Nessus	Mandriva Local Security Checks	medium
12518	Mac OS X Multiple Vulnerabilities (Security Update 2004-05-03)	Nessus	MacOS X Local Security Checks	high
12473	RHEL 3 : httpd (RHSA-2004:084)	Nessus	Red Hat Local Security Checks	medium
12100	Apache 2.0.x < 2.0.49 mod_ssl Plain HTTP Request DoS	Nessus	Web Servers	medium
800551	Apache HTTP Server < 2.0.49 mod_ssl Plain HTTP Request DoS	Log Correlation Engine	Web Servers	medium

Detections

Analytics

CVE-2004-0113

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

high

medium

medium

medium