vulnwire
7.8high

CVE-2004-09402 exploits

Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execut…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
4.8%
percentile 92%
Public exploits
2
Exploit-DB

Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.

Exploit prediction (EPSS)

4.83% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

Exploits and detections

  • EDB-587 Apache 1.3.31 mod_include - Local Buffer Overflow · local · 2004-10-21
  • EDB-24694 Apache 1.3.x mod_include - Local Buffer Overflow · local · 2004-10-18

CVSS scores

Assigned byVersionScoreVector
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.06.9AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size
Technology feeds
Apache HTTP Server (RSS, critical only)

References

  • marc.info /?l=bugtraq&m=109906660225051&w=2 · vendor-advisory, x_refsource_OPENPKG, x_transferred
  • apacheweek.com /features/security-13 · x_refsource_CONFIRM, x_transferred
  • support.avaya.com /elmodocs2/security/ASA-2006-081.htm · x_refsource_CONFIRM, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2004:134 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/17785 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/11471 · vdb-entry, x_refsource_BID, x_transferred
  • redhat.com /support/errata/RHSA-2005-816.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/12898/ · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2004/dsa-594 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/19073 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1011783 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • redhat.com /support/errata/RHSA-2004-600.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • sunsolve.sun.com /search/document.do?assetkey=1-26-102197-1 · vendor-advisory, x_refsource_SUNALERT, x_transferred
  • vupen.com /english/advisories/2006/0789 · vdb-entry, x_refsource_VUPEN, x_transferred
  • lists.apache.org /thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r5419c9ba0951ef73a655362403d12bb8d10fab38274deb3f005816f5%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r734a07156abf332d5ab27fb91d9d962cacfef4f3681e44056f064fa8%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred
  • lists.apache.org /thread.html/rf2f0f3611f937cf6cfb3b4fe4a67f69885855126110e1e3f2fb2728e%40%3Ccvs.httpd.apac · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.