CVE-2005-3357

mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.

Score

CVSS 2.0 5.4 Medium

Status

Modified - secalert@redhat.com

Published

2005-12-31

Last modified

2024-08-07

Weaknesses

CWE-399

Affected products

• Http Server (Apache)

References

• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449
• http://issues.apache.org/bugzilla/show_bug.cgi?id=37791
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
• http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html
• http://marc.info/?l=bugtraq&m=130497311408250&w=2
• http://rhn.redhat.com/errata/RHSA-2006-0159.html
• http://secunia.com/advisories/18307
• http://secunia.com/advisories/18333
• http://secunia.com/advisories/18339
• http://secunia.com/advisories/18340
• http://secunia.com/advisories/18429
• http://secunia.com/advisories/18517
• http://secunia.com/advisories/18585
• http://secunia.com/advisories/18743
• http://secunia.com/advisories/19012
• http://secunia.com/advisories/21848
• http://secunia.com/advisories/22233
• http://secunia.com/advisories/22368
• http://secunia.com/advisories/22523
• http://secunia.com/advisories/22669
• http://secunia.com/advisories/22992
• http://secunia.com/advisories/23260
• http://secunia.com/advisories/29849
• http://secunia.com/advisories/30430
• http://securitytracker.com/id?1015447
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102640-1
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1
• http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm
• http://svn.apache.org/viewcvs?rev=358026&view=rev