Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2002-0392 — Apache Http Server vulnerability

10 documents8 sources
Severity
7.5HIGHNVD
EPSS
53.9%
top 1.99%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Apache Http ServerDebian Linux
Timeline
PublishedJul 3
Latest updateMay 3

Description

Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDapache/http_server1.2.2 — 1.3.24+1

Also affects: Debian Linux 2.2

Patches

Patch: www.cert.org ↗Patch: www.cert.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-4wcr-f6x9-g539: Apache 1↗2022-05-03
▶
CVEList
CVE-2002-0392: Apache 1↗2003-04-02
▶
OSV
CVE-2002-0392: Apache 1↗2002-07-03
▶

💥Exploits & PoCs

3
Exploit-DB
Apache (Windows x86) - Chunked Encoding (Metasploit)↗2010-07-07
▶
Exploit-DB
Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (2)↗2002-06-17
▶
Exploit-DB
Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (1)↗2002-06-17
▶

📋Vendor Advisories

2
Red Hat
security flaw↗2002-06-17
▶
Debian
CVE-2002-0392: apache2 - Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attacker...↗2002
▶

💬Community

1
Bugzilla
CVE-2002-0392 security flaw↗2018-08-16
▶
CVE-2002-0392 — Apache Http Server vulnerability | cvebase