Red Hat Bugzilla – Bug 128170
CAN-2004-0700 mod_ssl format string vulnerability
Last modified: 2007-11-30 17:06:54 EST
Triggered by a report to Packet Storm [1] from Virulent, a format string vulnerability was found in mod_ssl [2], the Apache SSL/TLS interface to OpenSSL, version (up to and including) 2.8.18 for Apache 1.3. The mod_ssl in Apache 2.x is not affected. The vulnerability could be exploitable if Apache is used as a proxy for HTTPS URLs and the attacker established a own specially prepared DNS and origin server environment. More information here: http://packetstormsecurity.org/filedesc/modsslFormat.txt.html We're still investigating if this is actually an issue.
An errata is in progress for this issue, but it a low risk. From the upcoming advisory text: "A format string issue was discovered in mod_ssl for Apache 1.3 which can be triggered if mod_ssl is configured to allow a client to proxy to remote SSL sites. If mod_ssl is forced to connect to a remote SSL server using a carefully crafted hostname, an attacker may be able to crash an Apache child process. This issue is not known to allow arbitrary execution of code."
An errata has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2004-408.html