Bug 152727 - Apache mod_ssl "ssl_util_uuencode_binary" Buffer Overflow
Apache mod_ssl "ssl_util_uuencode_binary" Buffer Overflow
Product: Fedora Legacy
Classification: Retired
Component: Package request (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Fedora Legacy Bugs
Depends On:
  Show dependency treegraph
Reported: 2004-06-02 02:23 EDT by John Dalbec
Modified: 2008-05-01 11:38 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description David Lawrence 2005-03-30 18:25:23 EST
(4) LOW: Apache mod_ssl "ssl_util_uuencode_binary" Buffer Overflow
Affected: Apache version 1.3.x and 2.x configured with "mod_ssl" support.

Description: The "mod_ssl" module provides cryptography support for the
Apache webserver. This module contains a stack-based buffer overflow in
its "ssl_util_uuencode_binary" function. The flaw can be triggered by
an overlong "Subject-DN" in a specially crafted client certificate, if
the certificate's Certificate Authority (CA) is trusted and the
"mod_ssl" module is configured with "FakeBasicAuth" option. Exploiting
this flaw to execute arbitrary code on the x86 architecture is
reportedly not possible. However, it may be possible to execute
arbitrary code when Apache is installed on other machine architectures
(not confirmed). The technical details regarding the flaw have been

------- Additional Comments From jkeating@j2solutions.net 2004-06-02 11:03:47 ----

*** This bug has been marked as a duplicate of 1708 ***

------- Bug moved to this database by dkl@redhat.com 2005-03-30 18:25 -------

This bug previously known as bug 1702 at https://bugzilla.fedora.us/
Originally filed under the Fedora Legacy product and Package request component.

Unknown priority P2. Setting to default priority "normal".
Unknown platform PC. Setting to default platform "All".
Setting qa contact to the default for this product.
   This bug either had no qa contact or an invalid one.

Note You need to log in before you can comment on or make changes to this bug.