1. CVE-Search
  2. CVE-2004-0700
ID CVE-2004-0700
Summary Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
References
Vulnerable Configurations
  • cpe:2.3:a:mod_ssl:mod_ssl:2.3.11:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.3.11:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.8:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.9:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.4.10:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.5.0:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.5.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.5.2:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.5.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.7:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.8:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.9:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.10:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.12:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.12:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.14:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.14:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.15:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.15:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.16:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.16:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.17:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.17:*:*:*:*:*:*:*
  • cpe:2.3:a:mod_ssl:mod_ssl:2.8.18:*:*:*:*:*:*:*
    cpe:2.3:a:mod_ssl:mod_ssl:2.8.18:*:*:*:*:*:*:*
  • cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*
    cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 11-07-2017 - 01:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2004:405
  • rhsa
    id RHSA-2004:408
rpms
  • jabberd-0:2.0s10-3.37.rhn
  • jabberd-0:2.0s10-3.38.rhn
  • rhn-apache-0:1.3.27-36.rhn.rhel3
  • rhn-apache-0:1.3.27-36.rhn.rhel4
  • rhn-modperl-0:1.29-16.rhel3
  • rhn-modperl-0:1.29-16.rhel4
refmap via4
bid 10736
bugtraq 20040716 [OpenPKG-SA-2004.032] OpenPKG Security Advisory (apache)
cert-vn VU#303448
conectiva CLA-2004:857
debian DSA-532
fedora FLSA:1888
mandrake MDKSA-2004:075
misc
mlist [apache-modssl] 20040716 [ANNOUNCE] mod_ssl 2.8.19 for Apache 1.3.31
osvdb 7929
ubuntu USN-177-1
xf apache-modssl-format-string(16705)
Last major update 11-07-2017 - 01:30
Published 27-07-2004 - 04:00
Last modified 11-07-2017 - 01:30
Back to Top