CVE-2003-0132
published 2003-04-11CVE-2003-0132: A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters…
PriorityP429medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
86.18%
99.7th percentile
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 2.0.0 – 2.0.44 | — |
| debian | apache2 | < apache2 2.0.45 (bookworm) | apache2 2.0.45 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
0x0D 0x0A (repeated newline pairs sent in bulk over TCP)
- →Detect TCP connections to port 80/443 sending extremely large payloads composed almost entirely of linefeed (0x0A) or CRLF (0x0D 0x0A) characters with no valid HTTP request structure — indicative of the DoS exploit pattern. ↗
- →Alert on Apache processes exhibiting rapid memory growth without corresponding legitimate HTTP request volume; each linefeed causes Apache to allocate 80 bytes, so 8 million newlines would consume ~640 MB. ↗
- →Monitor for persistent TCP connections to Apache that continuously stream CRLF pairs in a loop without ever sending a complete HTTP request line — matching the apache-massacre.c loop behavior. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2003-04-02·CVSS 5.0
CVE-2003-0132 [MEDIUM] security flaw
security flaw
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
Debian
CVE-2003-0132: apache2 - A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a de...
vendor_debian·2003·CVSS 5.0
CVE-2003-0132 [MEDIUM] CVE-2003-0132: apache2 - A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a de...
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
Scope: local
bookworm: resolved (fixed in 2.0.45)
bullseye: resolved (fixed in 2.0.45)
forky: resolved (fixed in 2.0.45)
sid: resolved (fixed in 2.0.45)
trixie: resolved (fixed in 2.0.45)
GHSA
GHSA-g3vc-c43j-gjjv: A memory leak in Apache 2
ghsa_unreviewed·2022-04-29
CVE-2003-0132 [MEDIUM] CWE-772 GHSA-g3vc-c43j-gjjv: A memory leak in Apache 2
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
OSV
CVE-2003-0132: A memory leak in Apache 2
osv·2003-04-11·CVSS 5.0
CVE-2003-0132 [MEDIUM] CVE-2003-0132: A memory leak in Apache 2
A memory leak in Apache 2.0 through 2.0.44 allows remote attackers to cause a denial of service (memory consumption) via large chunks of linefeed characters, which causes Apache to allocate 80 bytes for each linefeed.
No detection rules found.
Exploit-DB
Apache 2.0.44 (Linux) - Remote Denial of Service
exploitdb·2003-04-11
CVE-2003-0132 Apache 2.0.44 (Linux) - Remote Denial of Service
Apache 2.0.44 (Linux) - Remote Denial of Service
---
/******** th-apachedos.c ********************************************************
* *
* Remote Apache DoS exploit *
* ------------------------- *
* Written as a poc for the: *
*
* This program sends 8000000 \n's to exploit the Apache memory leak. *
* Works from scratch under Linux, as opposed to apache-massacre.c . *
*
*
* Daniel Nyström *
*
* - www.telhack.tk - *
*
******************************************************** th-apachedos.c ********/
#include
#include
#include
#include
#include
#include
#include
#include
int main(int argc, char *argv[])
{
int sockfd;
int count;
char buffer[8000000];
struct sockaddr_in target;
struct hostent *he;
if (argc != 3)
{
fprintf(stderr, "\nTH-apachedos.c - Apache \n\n", argv[0]);
exit(-1);
}
p
Exploit-DB
Apache 2.x - Memory Leak
exploitdb·2003-04-09
CVE-2003-0132 Apache 2.x - Memory Leak
Apache 2.x - Memory Leak
---
/* apache-massacre.c
* Test code for Apache 2.x Memory Leak
* By Matthew Murphy
*
* DISCLAIMER: This exploit tool is provided only to test networks for a
* known vulnerability. Do not use this tool on systems you do not control,
* and do not use this tool on networks you do not own without appropriate
* consent from the network owner. You are responsible for any damage your
* use of the tool causes. In no event may the author of this tool be held
* responsible for damages relating to its use.
*
* As with most Apache exposures, the impacts vary between ports of the server:
*
* Non-Unix (Win32, Netware, OS/2): These ports are most adversely affected
* by this, as Apache's child process doesn't terminate normally unless the
* parent process stops. This means tha
http://lists.apple.com/mhonarc/security-announce/msg00028.htmlhttp://marc.info/?l=bugtraq&m=104931360606484&w=2http://marc.info/?l=bugtraq&m=104982175321731&w=2http://marc.info/?l=bugtraq&m=104994239010517&w=2http://marc.info/?l=bugtraq&m=104994309010974&w=2http://marc.info/?l=bugtraq&m=105001663120995&w=2http://marc.info/?l=bugtraq&m=105013378320711&w=2http://secunia.com/advisories/34920http://secunia.com/advisories/8499http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=205147http://www.idefense.com/advisory/04.08.03.txthttp://www.kb.cert.org/vuls/id/206537http://www.redhat.com/support/errata/RHSA-2003-139.htmlhttp://www.vupen.com/english/advisories/2009/1233https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A156http://lists.apple.com/mhonarc/security-announce/msg00028.htmlhttp://marc.info/?l=bugtraq&m=104931360606484&w=2http://marc.info/?l=bugtraq&m=104982175321731&w=2http://marc.info/?l=bugtraq&m=104994239010517&w=2http://marc.info/?l=bugtraq&m=104994309010974&w=2http://marc.info/?l=bugtraq&m=105001663120995&w=2http://marc.info/?l=bugtraq&m=105013378320711&w=2http://secunia.com/advisories/34920http://secunia.com/advisories/8499http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=205147http://www.idefense.com/advisory/04.08.03.txthttp://www.kb.cert.org/vuls/id/206537http://www.redhat.com/support/errata/RHSA-2003-139.htmlhttp://www.vupen.com/english/advisories/2009/1233https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r7035b7c9091c4b665a3b7205364775410646f12125d48e74e395f2ce%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd00b45b93fda4a5bd013b28587207d0e00f99f6e3308dbb6025f3b01%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re028d61fe612b0908595d658b9b39e74bca56f2a1ed3c5f06b5ab571%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A156
2003-04-11
Published