Vulnerability in Apache HTTP Server
CVE-2010-0010
Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.434 (98.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.434 · newest: 0.434 · change: 0.000
Affected products
- Apache HTTP Server — versions 1.3.20, 1.3.25, 1.3.28
Weakness classification (CWE)
References
- archives.neohapsis.com/archives/fulldisclosure/2010-01/0589.html (mailing-list, Exploit)
- blog.pi3.com.pl/
- httpd.apache.org/dev/dist/CHANGES_1.3.42
- lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html (vendor-advisory)
- marc.info/ (vendor-advisory)
- packetstormsecurity.org/1001-exploits/modproxy-overflow.txt (Exploit)
- secunia.com/advisories/38319 (third-party-advisory, Vendor Advisory)
- secunia.com/advisories/39656 (third-party-advisory)
- site.pi3.com.pl/adv/mod_proxy.txt
- www.securityfocus.com/archive/1/509185/100/0/threaded (mailing-list)