CVE-2010-3872 Httpd: mod_fcgid: stack-based buffer overflow in fcgid_header_bucket_read() in modules/fcgid/fcgid_bucket.c
HighCVSS 7.5
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in the mod_fcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgid_bucket.c file in the fcgid_header_bucket_read() function, resulting in an application crash.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache mod fcgid | <= 2.3.5 | No fix listed |
| apache mod fcgid | = 2.3.1 | No fix listed |
| apache mod fcgid | = 2.3.2 | No fix listed |
| apache mod fcgid | = 2.3.3 | No fix listed |
| apache mod fcgid | = 2.3.4 | No fix listed |
| debian/libapache2-mod-fcgid(Debian:12) | < 1:2.3.6-1 | 1:2.3.6-1 |
| debian/libapache2-mod-fcgid(Debian:13) | < 1:2.3.6-1 | 1:2.3.6-1 |
| debian/libapache2-mod-fcgid(Debian:14) | < 1:2.3.6-1 | 1:2.3.6-1 |
| redhat enterprise linux | = 7 | No fix listed |
| redhat enterprise linux | = 8 | No fix listed |
| redhat enterprise linux | = 9 | No fix listed |
| Fedora | All versions | No fix listed |
References
- FEDORA-2010-17474 vendor-advisory
- FEDORA-2010-17434 vendor-advisory
- FEDORA-2010-17472 vendor-advisory
- openSUSE-SU-2011:0884 vendor-advisory
- SUSE-SU-2011:0885 vendor-advisory
- 69275 vdb-entry
- 42288 third-party-advisory vendor-advisory
- 42302 third-party-advisory vendor-advisory
- 42815 third-party-advisory
- DSA-2140 vendor-advisory
- [apache] 20101107 [ANNOUNCE] mod_fcgid 2.3.6 is released mailing-list
- 44900 vdb-entry
- ADV-2010-2997 vdb-entry vendor-advisory
- ADV-2010-2998 vdb-entry vendor-advisory
- ADV-2011-0031 vdb-entry
- access.redhat.com vdb-entry
- RHBZ#2248172 issue-tracking
- apache-fcgid-bo(63303) vdb-entry
- github.com
- issues.apache.org patch
- Debian Security Tracker CVE-2010-3872 vendor-advisory
- bugs.debian.org issue-tracking