CVE-2002-1850 mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data t...
HighCVSS 7.5
EPSS 17.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | = 2.0.39 | No fix listed |
| Apache HTTP Server | = 2.0.40 | No fix listed |
| debian/apache2(Debian:12) | < 2.0.42-1 | 2.0.42-1 |
| debian/apache2(Debian:13) | < 2.0.42-1 | 2.0.42-1 |
| debian/apache2(Debian:14) | < 2.0.42-1 | 2.0.42-1 |
References
- Debian Security Tracker CVE-2002-1850 vendor-advisory
- cvs.apache.org broken-link
- issues.apache.org issue-tracking
- issues.apache.org issue-tracking patch
- [apache-httpd-dev] 20020925 CGI bucket needed mailing-list
- 20020923 Apache 2.0.(39|40) DOS (PHP!) exploit mailing-list third-party-advisory
- 1007823 broken-link patch third-party-advisory vdb-entry
- apache-stderr-dos(10200) broken-link patch vdb-entry
- 5787 broken-link exploit third-party-advisory vdb-entry
- 8725 broken-link patch third-party-advisory vdb-entry