SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   mod_python Vendors:   Apache Software Foundation
Apache mod_python String Processing Bug Still Lets Remote Users Crash the Web Server
SecurityTracker Alert ID:  1008828
SecurityTracker URL:  http://securitytracker.com/id/1008828
CVE Reference:   CVE-2004-0096   (Links to External Site)
Updated:  Feb 25 2004
Original Entry Date:  Jan 23 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.7.9
Description:   A vulnerability was reported in Apache mod_python. A remote user can cause the Apache server to crash.

It is reported that a remote user can issue a specific query string to be processed by mod_python to cause the Apache httpd process to crash.

The vendor indicates that this flaw was previously reported and was to have been fixed by version 2.7.9, but was not properly fixed in that version.

[Editor's note: The previously reported flaw was discussed in Alert ID 1008335 and CVE number CVE-2003-0973 in November 2003.]

Impact:   A remote user can cause the Apache web service to crash.
Solution:   The vendor has issued a fixed version (2.7.10) and recommends that users of mod_python 2.7.9 or earlier upgrade to 2.7.10 as soon as possible, available at:

http://httpd.apache.org/modules/python-download.cgi

The vendor indicates that users of mod_python 3.0.4 do not need to do anything.

Vendor URL:  www.modpython.org/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.


 Source Message Contents

Subject:  [ANNOUNCE] Mod_python 2.7.10



The Apache Software Foundation and The Apache HTTP Server Project are
pleased to announce the release of version 2.7.10 of mod_python.

This release addresses a vulnerability in mod_python 2.7.9 whereby a
specific query string processed by mod_python would cause the httpd
process to crash.

The previously released version 2.7.9 was supposed to correct this issue,
but is still vulnerable.

There are no other changes or improvements from the previous version in
this release.

If you are currently using mod_python 2.7.9 or earlier, it is highly
recommended that you upgrade to 2.7.10 as soon as possible.

If you are using mod_python 3.0.4, no action is necessary.

Mod_python is available for download from:

http://httpd.apache.org/modules/python-download.cgi

For more information about mod_python visit
http://www.modpython.org/

Regards,

Grisha Trubetskoy


---------------------------------------------------------------------
To unsubscribe, e-mail: announce-unsubscribe@httpd.apache.org
For additional commands, e-mail: announce-help@httpd.apache.org


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC