CVE-2002-0392
published 2002-07-03CVE-2002-0392: Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a…
PriorityP181high7.5CVSS 2.0
AVNACLAuNCPIPAP
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
95.03%
99.9th percentile
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 1.2.2 – 1.3.24 | — |
| apache | http_server | 2.0.0 – 2.0.36 | — |
| debian | apache2 | < apache2 2.0.37 (bookworm) | apache2 2.0.37 (bookworm) |
| debian | debian_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
FFFFFFF0 (chunk size integer wrap value in Transfer-Encoding: CHUNKED request)
- →Detect HTTP requests with Transfer-Encoding: CHUNKED header containing an oversized/wrapping chunk size value such as FFFFFFF0, which triggers the integer wrap in Apache 1.2.x–1.3.24 and 2.0–2.0.36. ↗
- →The Metasploit module targets Windows x86 Apache builds; exploitation results in privileged code execution. Alert on unexpected child process spawning from Apache (httpd.exe) on Windows systems running affected versions. ↗
- ·The exploit module requires use of the Check() function to determine the exact target version before launching; using the wrong target against Oracle 8.1.7 bundled Apache will crash the server without restart. ↗
- ·The vulnerability affects Apache 1.2.x through 1.3.24 and Apache 2.0 through 2.0.36; the module was specifically tested against official Win32 builds 1.3.9–1.3.24 and also targets co-branded versions (Oracle 8i/9i, IBM HTTPD). ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vulncheck7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4wcr-f6x9-g539: Apache 1
ghsa_unreviewed·2022-05-03
CVE-2002-0392 [HIGH] GHSA-4wcr-f6x9-g539: Apache 1
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
OSV
CVE-2002-0392: Apache 1
osv·2002-07-03·CVSS 7.5
CVE-2002-0392 [HIGH] CVE-2002-0392: Apache 1
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
VulnCheck
Apache HTTP Server Vulnerability
vulncheck·2002·CVSS 7.5
CVE-2002-0392 [HIGH] Apache HTTP Server Vulnerability
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Affected: Apache HTTP Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.exploit-db.com/exploits/21560
Red Hat
security flaw
vendor_redhat·2002-06-17·CVSS 7.5
CVE-2002-0392 [HIGH] security flaw
security flaw
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Debian
CVE-2002-0392: apache2 - Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attacker...
vendor_debian·2002·CVSS 7.5
CVE-2002-0392 [HIGH] CVE-2002-0392: apache2 - Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attacker...
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Scope: local
bookworm: resolved (fixed in 2.0.37)
bullseye: resolved (fixed in 2.0.37)
forky: resolved (fixed in 2.0.37)
sid: resolved (fixed in 2.0.37)
trixie: resolved (fixed in 2.0.37)
No detection rules found.
Exploit-DB
Apache (Windows x86) - Chunked Encoding (Metasploit)
exploitdb·2010-07-07
CVE-2002-0392 Apache (Windows x86) - Chunked Encoding (Metasploit)
Apache (Windows x86) - Chunked Encoding (Metasploit)
---
##
# $Id: apache_chunked.rb 9719 2010-07-07 17:38:59Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 [ /Apache/ ] }
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Apache Win32 Chunked Encoding',
'Description' => %q{
This module exploits the chunked transfer integer wrap
vulnerability in Apache version 1.2.x to 1.3.24. This
particular module has been tested with all versions of the
official Win32 build between 1.3.9 and 1
Exploit-DB
Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (2)
exploitdb·2002-06-17
CVE-2002-0392 Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (2)
Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (2)
---
// source: https://www.securityfocus.com/bid/5033/info
When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper (signed) interpretation of an unsigned integer value. Consequently, several conditions that have security implications may occur. Reportedly, a buffer overrun and signal race condition occur. Exploiting these conditions may allow arbitrary code to run.
**Update**: Reportedly, at least one worm is exploiting this vulnerability to propagate in the wild. The worm targets FreeBSD 4.5 systems running Apache 1.3.22-24 and 1.3.20. Other versions may also be affected.
/*
* apache-nosejob.c - Now with FreeBSD & Net
Exploit-DB
Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (1)
exploitdb·2002-06-17
CVE-2002-0392 Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (1)
Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (1)
---
// source: https://www.securityfocus.com/bid/5033/info
When processing requests coded with the 'Chunked Encoding' mechanism, Apache fails to properly calculate required buffer sizes. This is believed to be due to improper (signed) interpretation of an unsigned integer value. Consequently, several conditions that have security implications may occur. Reportedly, a buffer overrun and signal race condition occur. Exploiting these conditions may allow arbitrary code to run.
**Update**: Reportedly, at least one worm is exploiting this vulnerability to propagate in the wild. The worm targets FreeBSD 4.5 systems running Apache 1.3.22-24 and 1.3.20. Other versions may also be affected.
/*
* apache-scalp.c
* OPENBSD/X86 APACHE REMO
Metasploit
Apache Win32 Chunked Encoding
metasploit
Apache Win32 Chunked Encoding
Apache Win32 Chunked Encoding
This module exploits the chunked transfer integer wrap vulnerability in Apache version 1.2.x to 1.3.24. This particular module has been tested with all versions of the official Win32 build between 1.3.9 and 1.3.24. Additionally, it should work against most co-branded and bundled versions of Apache (Oracle 8i, 9i, IBM HTTPD, etc). You will need to use the Check() functionality to determine the exact target version prior to launching the exploit. The version of Apache bundled with Oracle 8.1.7 will not automatically restart, so if you use the wrong target value, the server will crash.
arXiv
ATAG: AI-Agent Application Threat Assessment with Attack Graphs
arxiv_fulltext·2025-06-03
ATAG: AI-Agent Application Threat Assessment with Attack Graphs
ATAG: AI-Agent Application Threat Assessment with Attack Graphs
Parth Atulbhai Gandhi, Akansha Shukla, David Tayouri, Beni Ifland, Yuval Elovici, Rami Puzis and Asaf Shabtai
Dept. of Software and Information Systems Engineering
Ben-Gurion University of the Negev
Beer-Sheva, Israel
\gandhip, akansha, davidtay, ifliandb\@post.bgu.ac.il, \elovici, puzis, shabtaia\@bgu.ac.il
## Abstract
Evaluating the security of multi-agent systems (MASs) powered by LLM is challenging, primarily because of the systems' complex internal dynamics and the evolving nature of LLM vulnerabilities.
Traditional AG methods often lack the specific capabilities to model attacks on LLMs.
This paper introduces ATAG, a novel framework designed to systematically analyze the security risks associated with AI-agent appl
arXiv
MIRAGE: Multi-Binary Image Risk Assessment with Attack Graph Employment
arxiv_fulltext·2023-11-06
MIRAGE: Multi-Binary Image Risk Assessment with Attack Graph Employment
MIRAGE: Multi-Binary Image Risk Assessment with Attack Graph Employment
David Tayouri, Telem Nachum, Asaf Shabtai
Dept. of Software and Information Systems Engineering
Ben-Gurion University of the Negev
Beer-Sheva, Israel
\davidtay,telemn\@post.bgu.ac.il, [email protected]
## Abstract
Attackers can exploit known vulnerabilities to infiltrate a device's firmware and the communication between firmware binaries, in order to pass between them.
To improve cybersecurity, organizations must identify and mitigate the risks of the firmware they use.
An attack graph (AG) can be used to assess and visually display firmware's risks by organizing the identified vulnerabilities into attack paths composed of sequences of actions attackers may perform to compromise firmware images.
In this paper,
arXiv
A Survey of MulVAL Extensions and Their Attack Scenarios Coverage
arxiv_fulltext·2022-08-11
A Survey of MulVAL Extensions and Their Attack Scenarios Coverage
A Survey of MulVAL Extensions and Their Attack Scenarios Coverage
David Tayouri, Nick Baum, Asaf Shabtai, Rami Puzis
Dept. of Software and Information Systems Engineering
Ben-Gurion University of the Negev
Beer-Sheva, Israel
\davidtay,nicita\@post.bgu.ac.il, \shabtaia,puzis\@bgu.ac.il
## Abstract
Organizations employ various adversary models in order to assess the risk and potential impact of attacks on their networks.
Attack graphs represent vulnerabilities and actions an attacker can take to identify and compromise an organization's assets.
Attack graphs facilitate both visual presentation and algorithmic analysis of attack scenarios in the form of attack paths.
MulVAL is a generic open-source framework for constructing logical attack graphs, which has been widely used by research
arXiv
Ontology-based Attack Graph Enrichment
arxiv_fulltext·2022-02-08
Ontology-based Attack Graph Enrichment
Abstract: Attack graphs provide a representation of possible actions that adversaries can perpetrate to attack a system. They are used by cybersecurity experts to make decisions, e.g., to decide
remediation and recovery plans. Different approaches can be used to build such graphs. We focus on logical attack graphs, based on predicate logic, to define the causality of adversarial actions. Since networks and vulnerabilities are constantly changing (e.g., new applications get installed on system devices, updated services get publicly exposed, etc.), we propose to enrich the attack graph generation approach with a semantic augmentation post-processing of the predicates. Graphs are now mapped to monitoring alerts confirming successful attack actions and updated according to network and vulnerab
Bugzilla
CVE-2002-0392 security flaw
bugzilla·2018-08-16·CVSS 7.5
CVE-2002-0392 [HIGH] CVE-2002-0392 security flaw
CVE-2002-0392 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txtftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31ftp://patches.sgi.com/support/free/security/advisories/20020605-01-Aftp://patches.sgi.com/support/free/security/advisories/20020605-01-Ihttp://archives.neohapsis.com/archives/bugtraq/2002-06/0235.htmlhttp://archives.neohapsis.com/archives/bugtraq/2002-06/0266.htmlhttp://distro.conectiva.com/atualizacoes/?id=a&anuncio=000498http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:039http://httpd.apache.org/info/security_bulletin_20020617.txthttp://online.securityfocus.com/advisories/4240http://online.securityfocus.com/advisories/4257http://online.securityfocus.com/archive/1/278149http://rhn.redhat.com/errata/RHSA-2002-103.htmlhttp://rhn.redhat.com/errata/RHSA-2002-117.htmlhttp://rhn.redhat.com/errata/RHSA-2002-118.htmlhttp://secunia.com/advisories/21917http://www.cert.org/advisories/CA-2002-17.htmlhttp://www.debian.org/security/2002/dsa-131http://www.debian.org/security/2002/dsa-132http://www.debian.org/security/2002/dsa-133http://www.frsirt.com/english/advisories/2006/3598http://www.iss.net/security_center/static/9249.phphttp://www.kb.cert.org/vuls/id/944335http://www.linuxsecurity.com/advisories/other_advisory-2137.htmlhttp://www.novell.com/linux/security/advisories/2002_22_apache.htmlhttp://www.osvdb.org/838http://www.redhat.com/support/errata/RHSA-2002-126.htmlhttp://www.redhat.com/support/errata/RHSA-2002-150.htmlhttp://www.redhat.com/support/errata/RHSA-2003-106.htmlhttp://www.securityfocus.com/bid/20005http://www.securityfocus.com/bid/5033http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000083816475https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Eftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-029.0.txtftp://ftp.caldera.com/pub/updates/OpenServer/CSSA-2002-SCO.32ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.31ftp://patches.sgi.com/support/free/security/advisories/20020605-01-Aftp://patches.sgi.com/support/free/security/advisories/20020605-01-Ihttp://archives.neohapsis.com/archives/bugtraq/2002-06/0235.htmlhttp://archives.neohapsis.com/archives/bugtraq/2002-06/0266.htmlhttp://distro.conectiva.com/atualizacoes/?id=a&anuncio=000498http://frontal2.mandriva.com/security/advisories?name=MDKSA-2002:039http://httpd.apache.org/info/security_bulletin_20020617.txthttp://online.securityfocus.com/advisories/4240http://online.securityfocus.com/advisories/4257http://online.securityfocus.com/archive/1/278149http://rhn.redhat.com/errata/RHSA-2002-103.htmlhttp://rhn.redhat.com/errata/RHSA-2002-117.htmlhttp://rhn.redhat.com/errata/RHSA-2002-118.htmlhttp://secunia.com/advisories/21917http://www.cert.org/advisories/CA-2002-17.htmlhttp://www.debian.org/security/2002/dsa-131http://www.debian.org/security/2002/dsa-132http://www.debian.org/security/2002/dsa-133http://www.frsirt.com/english/advisories/2006/3598http://www.iss.net/security_center/static/9249.phphttp://www.kb.cert.org/vuls/id/944335http://www.linuxsecurity.com/advisories/other_advisory-2137.htmlhttp://www.novell.com/linux/security/advisories/2002_22_apache.htmlhttp://www.osvdb.org/838http://www.redhat.com/support/errata/RHSA-2002-126.htmlhttp://www.redhat.com/support/errata/RHSA-2002-150.htmlhttp://www.redhat.com/support/errata/RHSA-2003-106.htmlhttp://www.securityfocus.com/bid/20005http://www.securityfocus.com/bid/5033http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000083816475https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
2002-07-03
Published
Exploited in the wild