Release Date: 2004-03-10
Critical: Less critical
Impact: DoS
Where: From remote
Software: Apache 2.0.x
CVE reference: CAN-2004-0113
Description:
Mick Wall has discovered a vulnerability in Apache 2, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to a handling error within the SSL engine when receiving normal HTTP requests on the SSL port of a SSL-enabled server. This causes memory leaks that eventually crash the process.
The vulnerability affects versions 2.0.35 through 2.0.48.
Solution:
The vulnerability has been fixed in Apache 2.0.49 development.
Provided and/or discovered by:
Mick Wall
Original Advisory:
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27106
Source: Secunia