(4) LOW: Apache mod_ssl "ssl_util_uuencode_binary" Buffer Overflow Affected: Apache version 1.3.x and 2.x configured with "mod_ssl" support. Description: The "mod_ssl" module provides cryptography support for the Apache webserver. This module contains a stack-based buffer overflow in its "ssl_util_uuencode_binary" function. The flaw can be triggered by an overlong "Subject-DN" in a specially crafted client certificate, if the certificate's Certificate Authority (CA) is trusted and the "mod_ssl" module is configured with "FakeBasicAuth" option. Exploiting this flaw to execute arbitrary code on the x86 architecture is reportedly not possible. However, it may be possible to execute arbitrary code when Apache is installed on other machine architectures (not confirmed). The technical details regarding the flaw have been posted. ------- Additional Comments From jkeating 2004-06-02 11:03:47 ---- *** This bug has been marked as a duplicate of 1708 *** ------- Bug moved to this database by dkl 2005-03-30 18:25 ------- This bug previously known as bug 1702 at https://bugzilla.fedora.us/ https://bugzilla.fedora.us/show_bug.cgi?id=1702 Originally filed under the Fedora Legacy product and Package request component. Unknown priority P2. Setting to default priority "normal". Unknown platform PC. Setting to default platform "All". Setting qa contact to the default for this product. This bug either had no qa contact or an invalid one.