ID CVE-2002-0839
Summary The shared memory scoreboard in the HTTP daemon for Apache 1.3.x before 1.3.27 allows any user running as the Apache UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or possibly other behaviors that would not normally be allowed, by modifying the parent[].pid and parent[].last_rtime segments in the scoreboard.
References
Vulnerable Configurations
  • Apache Software Foundation Apache HTTP Server 1.3.19
    cpe:2.3:a:apache:http_server:1.3.19
  • Apache Software Foundation Apache HTTP Server 1.3.20
    cpe:2.3:a:apache:http_server:1.3.20
  • Apache Software Foundation Apache HTTP Server 1.3.22
    cpe:2.3:a:apache:http_server:1.3.22
  • Apache Software Foundation Apache HTTP Server 1.3.23
    cpe:2.3:a:apache:http_server:1.3.23
  • Apache Software Foundation Apache HTTP Server 1.3.24
    cpe:2.3:a:apache:http_server:1.3.24
  • Apache Software Foundation Apache HTTP Server 1.3.25
    cpe:2.3:a:apache:http_server:1.3.25
  • Apache Software Foundation Apache HTTP Server 1.3.26
    cpe:2.3:a:apache:http_server:1.3.26
CVSS
Base: 7.2 (as of 01-01-2004 - 00:00)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2002-068.NASL
    description A number of vulnerabilities were discovered in Apache versions prior to 1.3.27. The first is regarding the use of shared memory (SHM) in Apache. An attacker that is able to execute code as the UID of the webserver (typically 'apache') is able to send arbitrary processes a USR1 signal as root. Using this vulnerability, the attacker can also cause the Apache process to continously span more children processes, thus causing a local DoS. Another vulnerability was discovered by Matthew Murphy regarding a cross site scripting vulnerability in the standard 404 error page. Finally, some buffer overflows were found in the 'ab' benchmark program that is included with Apache. All of these vulnerabilities were fixed in Apache 1.3.27; the packages provided have these fixes applied.
    last seen 2019-01-16
    modified 2018-11-15
    plugin id 13968
    published 2004-07-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=13968
    title Mandrake Linux Security Advisory : apache (MDKSA-2002:068)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-187.NASL
    description According to David Wagner, iDEFENSE and the Apache HTTP Server Project, several remotely exploitable vulnerabilities have been found in the Apache package, a commonly used webserver. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross scripting attack. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities : - CAN-2002-0839: A vulnerability exists on platforms using System V shared memory based scoreboards. This vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial of service attack. - CAN-2002-0840: Apache is susceptible to a cross site scripting vulnerability in the default 404 page of any web server hosted on a domain that allows wildcard DNS lookups. - CAN-2002-0843: There were some possible overflows in the utility ApacheBench (ab) which could be exploited by a malicious server. - CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program. - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. This is the same vulnerability as CAN-2002-1233, which was fixed in potato already but got lost later and was never applied upstream. - NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings. These problems have been fixed in version 1.3.26-0woody3 for the current stable distribution (woody) and in 1.3.9-14.3 for the old stable distribution (potato). Corrected packages for the unstable distribution (sid) are expected soon.
    last seen 2019-01-16
    modified 2018-07-20
    plugin id 15024
    published 2004-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15024
    title Debian DSA-187-1 : apache - several vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2002-251.NASL
    description Updated apache and httpd packages are available which fix a number of security issues for Red Hat Linux Advanced Server 2.1. [Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1 The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Buffer overflows in the ApacheBench support program (ab.c) in Apache versions prior to 1.3.27 allow a malicious Web server to cause a denial of service and possibly execute arbitrary code via a long response. The Common Vulnerabilities and Exposures project has assigned the name CVE-2002-0843 to this issue. Two cross-site scripting vulnerabilities are present in the error pages for the default '404 Not Found' error, and for the error response when a plain HTTP request is received on an SSL port. Both of these issues are only exploitable if the 'UseCanonicalName' setting has been changed to 'Off', and wildcard DNS is in use. These issues would allow remote attackers to execute scripts as other Web page visitors, for instance, to steal cookies. These issues affect versions of Apache 1.3 before 1.3.26, and versions of mod_ssl before 2.8.12. The Common Vulnerabilities and Exposures project has assigned the names CVE-2002-0840 and CVE-2002-1157 to these issues. The shared memory scoreboard in the HTTP daemon for Apache 1.3, prior to version 1.3.27, allowed a user running as the 'apache' UID to send a SIGUSR1 signal to any process as root, resulting in a denial of service (process kill) or other such behavior that would not normally be allowed. The Common Vulnerabilities and Exposures project has assigned the name CVE-2002-0839 to this issue. All users of the Apache HTTP server are advised to upgrade to the applicable errata packages. For Red Hat Linux Advanced Server 2.1 these packages include Apache version 1.3.27 which is not vulnerable to these issues. Note that the instructions in the 'Solution' section of this errata contain additional steps required to complete the upgrade process.
    last seen 2019-01-16
    modified 2018-11-15
    plugin id 12332
    published 2004-07-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=12332
    title RHEL 2.1 : apache (RHSA-2002:251)
  • NASL family HP-UX Local Security Checks
    NASL id HPUX_PHSS_28111.NASL
    description s700_800 11.04 Virtualvault 4.5 IWS Update : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen 2019-01-16
    modified 2013-04-20
    plugin id 17492
    published 2005-03-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17492
    title HP-UX PHSS_28111 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL family Web Servers
    NASL id APACHE_1_3_27.NASL
    description The remote host is running a version of Apache web server prior to 1.3.27. It is, therefore, affected by multiple vulnerabilities : - There is a cross-site scripting vulnerability caused by a failure to filter HTTP/1.1 'Host' headers that are sent by browsers. - A vulnerability in the handling of the Apache scorecard could allow an attacker to cause a denial of service. - A buffer overflow vulnerability exists in the 'support/ab.c' read_connection() function. The ab.c file is a benchmarking support utility that is provided with the Apache web server.
    last seen 2019-01-16
    modified 2018-11-15
    plugin id 11137
    published 2002-10-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=11137
    title Apache < 1.3.27 Multiple Vulnerabilities (DoS, XSS)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-195.NASL
    description According to David Wagner, iDEFENSE and the Apache HTTP Server Project, several vulnerabilities have been found in the Apache server package, a commonly used webserver. Most of the code is shared between the Apache and Apache-Perl packages, so vulnerabilities are shared as well. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross site scripting attack, or steal cookies from other website users. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities : - CAN-2002-0839: A vulnerability exists on platforms using System V shared memory based scoreboards. This vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial of service attack. - CAN-2002-0840: Apache is susceptible to a cross site scripting vulnerability in the default 404 page of any web server hosted on a domain that allows wildcard DNS lookups. - CAN-2002-0843: There were some possible overflows in the utility ApacheBench (ab) which could be exploited by a malicious server. No such binary programs are distributed by the Apache-Perl package, though. - CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program. No such binary programs are distributed by the Apache-Perl package, though. - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. No such binary programs are distributed by the Apache-Perl package, though. - NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings. No such binary programs are distributed by the Apache-Perl package, though. These problems have been fixed in version 1.3.26-1-1.26-0woody2 for the current stable distribution (woody), in 1.3.9-14.1-1.21.20000309-1.1 for the old stable distribution (potato) and in version 1.3.26-1.1-1.27-3-1 for the unstable distribution (sid).
    last seen 2019-01-16
    modified 2018-07-20
    plugin id 15032
    published 2004-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15032
    title Debian DSA-195-1 : apache-perl - several vulnerabilities
  • NASL family HP-UX Local Security Checks
    NASL id HPUX_PHSS_28099.NASL
    description s700_800 11.04 Virtualvault 4.6 OWS update : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen 2019-01-16
    modified 2013-04-20
    plugin id 17491
    published 2005-03-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17491
    title HP-UX PHSS_28099 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL family HP-UX Local Security Checks
    NASL id HPUX_PHSS_28705.NASL
    description s700_800 11.X OV NNM6.2 Intermediate Patch, Feb 2003 : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen 2019-01-16
    modified 2013-04-20
    plugin id 16993
    published 2005-02-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=16993
    title HP-UX PHSS_28705 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-188.NASL
    description According to David Wagner, iDEFENSE and the Apache HTTP Server Project, several vulnerabilities have been found in the Apache package, a commonly used webserver. Most of the code is shared between the Apache and Apache-SSL packages, so vulnerabilities are shared as well. These vulnerabilities could allow an attacker to enact a denial of service against a server or execute a cross scripting attack, or steal cookies from other web site users. Vulnerabilities in the included legacy programs htdigest, htpasswd and ApacheBench can be exploited when called via CGI. Additionally the insecure temporary file creation in htdigest and htpasswd can also be exploited locally. The Common Vulnerabilities and Exposures (CVE) project identified the following vulnerabilities : - CAN-2002-0839: A vulnerability exists on platforms using System V shared memory based scoreboards. This vulnerability allows an attacker to execute code under the Apache UID to exploit the Apache shared memory scoreboard format and send a signal to any process as root or cause a local denial of service attack. - CAN-2002-0840: Apache is susceptible to a cross site scripting vulnerability in the default 404 page of any web server hosted on a domain that allows wildcard DNS lookups. - CAN-2002-0843: There were some possible overflows in the utility ApacheBench (ab) which could be exploited by a malicious server. - CAN-2002-1233: A race condition in the htpasswd and htdigest program enables a malicious local user to read or even modify the contents of a password file or easily create and overwrite files as the user running the htpasswd (or htdigest respectively) program. (binaries not included in apache-ssl package though) - CAN-2001-0131: htpasswd and htdigest in Apache 2.0a9, 1.3.14, and others allows local users to overwrite arbitrary files via a symlink attack. This is the same vulnerability as CAN-2002-1233, which was fixed in potato already but got lost later and was never applied upstream. (binaries not included in apache-ssl package though) - NO-CAN: Several buffer overflows have been found in the ApacheBench (ab) utility that could be exploited by a remote server returning very long strings. (binary not included in apache-ssl package though) These problems have been fixed in version 1.3.26.1+1.48-0woody3 for the current stable distribution (woody) and in 1.3.9.13-4.2 for the old stable distribution (potato). Corrected packages for the unstable distribution (sid) are expected soon.
    last seen 2019-01-16
    modified 2018-07-20
    plugin id 15025
    published 2004-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=15025
    title Debian DSA-188-1 : apache-ssl - several vulnerabilities
  • NASL family HP-UX Local Security Checks
    NASL id HPUX_PHSS_28090.NASL
    description s700_800 11.04 Virtualvault 4.6 IWS update. : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen 2019-01-16
    modified 2013-04-20
    plugin id 17118
    published 2005-02-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17118
    title HP-UX PHSS_28090 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
  • NASL family HP-UX Local Security Checks
    NASL id HPUX_PHSS_28098.NASL
    description s700_800 11.04 Virtualvault 4.5 OWS update : Potential vulnerability regarding ownership permissions of System V shared memory based scoreboards. (CERT VU#825353, CVE CAN-2002-0839) Potential cross-site scripting vulnerability in the default error page when using wildcard DNS. (CERT VU#240329, CVE CAN-2002-0840) Potential overflows in ab.c which could be exploited by a malicious server. (CERT VU#858881, CVE CAN-2002-0843) Exposure of CGI source when a POST request is sent to a location where both DAV and CGI are enabled. (CERT VU#91071, CVE CAN-2002-1156).
    last seen 2019-01-16
    modified 2013-04-20
    plugin id 17490
    published 2005-03-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=17490
    title HP-UX PHSS_28098 : HP-UX Running Apache, Increased Privileges or Denial of Service (DoS) or Execution of Arbitrary Code (HPSBUX00224 SSRT2393 rev.3)
refmap via4
bid 5884
bugtraq
  • 20021003 [OpenPKG-SA-2002.009] OpenPKG Security Advisory (apache)
  • 20021015 GLSA: apache
  • 20021017 TSLSA-2002-0069-apache
conectiva CLA-2002:530
confirm
debian
  • DSA-187
  • DSA-188
  • DSA-195
engarde ESA-20021007-024
hp
  • HPSBOV02683
  • HPSBUX0210-224
  • SSRT090208
mandrake MDKSA-2002:068
sgi 20021105-01-I
vulnwatch 20021003 iDEFENSE Security Advisory 10.03.2002: Apache 1.3.x shared memory scoreboard vulnerabilities
xf apache-scorecard-memory-overwrite(10280)
statements via4
contributor Mark J Cox
lastmodified 2008-07-02
organization Apache
statement Fixed in Apache HTTP Server 1.3.27: http://httpd.apache.org/security/vulnerabilities_13.html
Last major update 17-10-2016 - 22:22
Published 11-10-2002 - 00:00
Back to Top