Overview
There is a format string vulnerability in the ssl_log() function of the mod_ssl module that could allow an attacker to potentially execute arbitrary code.
Description
mod_ssl is an Apache module that provides Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocol support. There is a format string vulnerability in way the ssl_log() function of the mod_ssl module handles hostnames. By supplying a specially crafted hostname value in an HTTPS request, a remote, unauthenticated attacker could trigger this vulnerability. Please note, the hostname provided would have to exist in the zone. |
Impact
A remote, unauthenticated attacker could potentially execute arbitrary code on an affected system. |
Solution
Upgrade Upgrade to version 2.8.19-1.3.31. Alternatively, apply the appropriate patch or upgrade as specified by your vendor. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported by Secunia.
This document was written by Damon Morda.
Other Information
| CVE IDs: | None |
| Severity Metric: | 6.04 |
| Date Public: | 2004-07-16 |
| Date First Published: | 2004-07-19 |
| Date Last Updated: | 2004-07-19 16:57 UTC |
| Document Revision: | 9 |