CVE-2004-0940
published 2005-02-09CVE-2004-0940: Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as…
PriorityP431high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
4.83%
91.0th percentile
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 1.3 – 1.3.32 | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| hp | hp-ux | — | — |
| openpkg | openpkg | — | — |
| openpkg | openpkg | — | — |
| openpkg | openpkg | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| slackware | slackware_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| suse | suse_linux | — | — |
| trustix | secure_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd mod_include SSI overflow
vendor_redhat·2004-10-21·CVSS 7.8
CVE-2004-0940 [HIGH] httpd mod_include SSI overflow
httpd mod_include SSI overflow
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
GHSA
GHSA-cx2h-jfxr-vw9c: Buffer overflow in the get_tag function in mod_include for Apache 1
ghsa_unreviewed·2022-04-29
CVE-2004-0940 [MEDIUM] CWE-119 GHSA-cx2h-jfxr-vw9c: Buffer overflow in the get_tag function in mod_include for Apache 1
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
No detection rules found.
Exploit-DB
Apache 1.3.31 mod_include - Local Buffer Overflow
exploitdb·2004-10-21
CVE-2004-0940 Apache 1.3.31 mod_include - Local Buffer Overflow
Apache 1.3.31 mod_include - Local Buffer Overflow
---
/*********************************************************************************
local exploit for mod_include of apache 1.3.x *
written by xCrZx /18.10.2004/ *
bug found by xCrZx /18.10.2004/ *
*
Successfully tested on apache 1.3.31 under Linux RH9.0(Shrike) *
*
*********************************************************************************/
/*********************************************************************************
Technical Details:
there is an overflow in get_tag function:
static char *get_tag(pool *p, FILE *in, char *tag, int tagbuf_len, int dodecode)
{
...
term = c;
while (1) {
GET_CHAR(in, c, NULL, p);
[1] if (t - tag == tagbuf_len) {
*t = '\0';
return NULL;
} *
// Want to accept \" as a valid character within a s
Exploit-DB
Apache 1.3.x mod_include - Local Buffer Overflow
exploitdb·2004-10-18
CVE-2004-0940 Apache 1.3.x mod_include - Local Buffer Overflow
Apache 1.3.x mod_include - Local Buffer Overflow
---
// source: https://www.securityfocus.com/bid/11471/info
The problem presents itself when the affected module attempts to parse mod_include-specific tag values. A failure to properly validate the lengths of user-supplied tag strings before copying them into finite buffers facilitates the overflow.
A local attacker may leverage this issue to execute arbitrary code on the affected computer with the privileges of the affected Apache server.
/*********************************************************************************
local exploit for mod_include of apache 1.3.x *
written by xCrZx /18.10.2004/ *
bug found by xCrZx /18.10.2004/ *
*
y0das old shao lin techniq ownz u :) remember my words *
http://lbyte.ru/16-masta_killa-16-mastakilla-
Bugzilla
CVE-2004-0940 httpd mod_include SSI overflow
bugzilla·2008-01-28·CVSS 7.8
CVE-2004-0940 [HIGH] CVE-2004-0940 httpd mod_include SSI overflow
CVE-2004-0940 httpd mod_include SSI overflow
Common Vulnerabilities and Exposures assigned an identifier CVE-2004-0940 to the following vulnerability:
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
References:
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
http://www.debian.org/security/2004/dsa-594
http://www.mandriva.com/security/advisories?name=MDKSA-2004:134
http://www.redhat.com/support/errata/RHSA-2004-600.html
http://marc.theaimsgroup.com/?l=bugtraq&m=109906660225051&w=2
http://www.apacheweek.com/features/security-13
http://www.redhat.com/support/errata/RHSA-2005-816.html
ht
Bugzilla
CVE-2003-0542 multiple flaws in Apache (CVE-2003-0542, CVE-2003-0987, CVE-2004-0940)
bugzilla·2005-10-25·CVSS 7.2
CVE-2003-0542 [HIGH] CVE-2003-0542 multiple flaws in Apache (CVE-2003-0542, CVE-2003-0987, CVE-2004-0940)
CVE-2003-0542 multiple flaws in Apache (CVE-2003-0542, CVE-2003-0987, CVE-2004-0940)
Several security issues have been found in various packages in Stronghold
4.0:
A flaw in the handling of regular expressions from configuration files
in the Apache HTTP Server could lead to a buffer overflow. To exploit this
issue, an attacker would need to have the ability to write to Apache
configuration files such as .htaccess or httpd.conf. (CVE-2003-0542)
mod_digest did not properly verify the nonce of a client response by using
a AuthNonce secret. This could allow a malicious user who is able to sniff
network traffic to conduct a replay attack against a website using Digest
protection. Note that mod_digest implements an older version of the MD5
Digest Authentication specification which is known no
CWE
Incorrect Calculation of Buffer Size
mitre_cwe
CWE-131 Incorrect Calculation of Buffer Size
CWE-131: Incorrect Calculation of Buffer Size
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Availability, Confidentiality. Impact: DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands, Read Memory, Modify Memory. If the incorrect calculation is used in the context of memory allocation, then the software may create a buffer that is smaller or larger than expected. If the allocated buffer is smaller than expected, this could lead to an out-of-bounds read or write (CWE-119), possibly causing a crash, allowing arbitrary code execution, or exposing sensitive data.
Detection Methods:
Automated Static Analysis: This
CWE
Improper Handling of Length Parameter Inconsistency
mitre_cwe
CWE-130 Improper Handling of Length Parameter Inconsistency
CWE-130: Improper Handling of Length Parameter Inconsistency
The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflow
http://marc.info/?l=bugtraq&m=109906660225051&w=2http://secunia.com/advisories/12898/http://secunia.com/advisories/19073http://securitytracker.com/id?1011783http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1http://support.avaya.com/elmodocs2/security/ASA-2006-081.htmhttp://www.apacheweek.com/features/security-13http://www.debian.org/security/2004/dsa-594http://www.mandriva.com/security/advisories?name=MDKSA-2004:134http://www.redhat.com/support/errata/RHSA-2004-600.htmlhttp://www.redhat.com/support/errata/RHSA-2005-816.htmlhttp://www.securityfocus.com/bid/11471http://www.vupen.com/english/advisories/2006/0789https://exchange.xforce.ibmcloud.com/vulnerabilities/17785https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttp://marc.info/?l=bugtraq&m=109906660225051&w=2http://secunia.com/advisories/12898/http://secunia.com/advisories/19073http://securitytracker.com/id?1011783http://sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1http://support.avaya.com/elmodocs2/security/ASA-2006-081.htmhttp://www.apacheweek.com/features/security-13http://www.debian.org/security/2004/dsa-594http://www.mandriva.com/security/advisories?name=MDKSA-2004:134http://www.redhat.com/support/errata/RHSA-2004-600.htmlhttp://www.redhat.com/support/errata/RHSA-2005-816.htmlhttp://www.securityfocus.com/bid/11471http://www.vupen.com/english/advisories/2006/0789https://exchange.xforce.ibmcloud.com/vulnerabilities/17785https://lists.apache.org/thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
2005-02-09
Published