Skip to content

CVE-2005-3357 mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) vi...

MediumCVSS 5.4 EPSS 24.3%
Published
Updated
Exploit status
No public exploit known

Description

mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.

Affected products

ProductAffected versionsFixed in
Apache HTTP Server = 2.0 No fix listed
Apache HTTP Server = 2.0.9 No fix listed
Apache HTTP Server = 2.0.28 No fix listed
Apache HTTP Server = 2.0.28-beta No fix listed
Apache HTTP Server = 2.0.32 No fix listed
Apache HTTP Server = 2.0.35 No fix listed
Apache HTTP Server = 2.0.36 No fix listed
Apache HTTP Server = 2.0.37 No fix listed
Apache HTTP Server = 2.0.38 No fix listed
Apache HTTP Server = 2.0.39 No fix listed
Apache HTTP Server = 2.0.40 No fix listed
Apache HTTP Server = 2.0.41 No fix listed
Apache HTTP Server = 2.0.42 No fix listed
Apache HTTP Server = 2.0.43 No fix listed
Apache HTTP Server = 2.0.44 No fix listed
Apache HTTP Server = 2.0.45 No fix listed
Apache HTTP Server = 2.0.46 No fix listed
Apache HTTP Server = 2.0.47 No fix listed
Apache HTTP Server = 2.0.48 No fix listed
Apache HTTP Server = 2.0.49 No fix listed
Apache HTTP Server = 2.0.50 No fix listed
Apache HTTP Server = 2.0.51 No fix listed
Apache HTTP Server = 2.0.52 No fix listed
Apache HTTP Server = 2.0.53 No fix listed
Apache HTTP Server = 2.0.54 No fix listed
Show 4 more
ProductAffected versionsFixed in
Apache HTTP Server = 2.0.55 No fix listed
debian/apache2(Debian:12) < 2.0.55-4 2.0.55-4
debian/apache2(Debian:13) < 2.0.55-4 2.0.55-4
debian/apache2(Debian:14) < 2.0.55-4 2.0.55-4

References