Vulnerability Name:

CVE-2004-0940 (CCN-17785)

Assigned:2004-10-19
Published:2004-10-19
Updated:2021-06-06
Summary:Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
CVSS v3 Severity:8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.9 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.2 Medium (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2004-0940

Source: CCN
Type: AppleCare Knowledge Base Document 61798
Security Update 2004-12-02

Source: CCN
Type: Apache Web site
Welcome! - The Apache HTTP Server Project

Source: OPENPKG
Type: UNKNOWN
OpenPKG-SA-2004.047

Source: CCN
Type: RHSA-2004-600
apache

Source: CCN
Type: RHSA-2005-816
apache

Source: CCN
Type: SA12898
Apache "mod_include" Privilege Escalation Vulnerability

Source: SECUNIA
Type: UNKNOWN
12898

Source: CCN
Type: SA19073
Sun Solaris Multiple Apache Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
19073

Source: CCN
Type: SECTRACK ID: 1011783
Apache mod_include Buffer Overflow Lets Local Users Execute Arbitrary Code

Source: SECTRACK
Type: UNKNOWN
1011783

Source: CCN
Type: slackware-security Mailing List, Mon, 1 Nov 2004 00:00:31 -0800 (PST)
[slackware-security] apache+mod_ssl (SSA:2004-305-01)

Source: SUNALERT
Type: UNKNOWN
102197

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm

Source: CONFIRM
Type: UNKNOWN
http://www.apacheweek.com/features/security-13

Source: CCN
Type: CIAC Information Bulletin P-025
Apache HTTP Server 1.3.33 Released

Source: CCN
Type: CIAC Information Bulletin P-049
Apple Security Update 2004-12-02

Source: DEBIAN
Type: UNKNOWN
DSA-594

Source: DEBIAN
Type: DSA-594
apache -- buffer overflows

Source: CCN
Type: GLSA-200411-03
Apache 1.3: Buffer overflow vulnerability in mod_include

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2004:134

Source: CCN
Type: OpenPKG-SA-2004.047
Apache mod_include

Source: REDHAT
Type: UNKNOWN
RHSA-2004:600

Source: REDHAT
Type: UNKNOWN
RHSA-2005:816

Source: BID
Type: Exploit, Patch, Vendor Advisory
11471

Source: CCN
Type: BID-11471
Apache mod_include Local Buffer Overflow Vulnerability

Source: CCN
Type: TLSA-2004-31
Multiple vulnerabilities exist in Apache

Source: VUPEN
Type: UNKNOWN
ADV-2006-0789

Source: XF
Type: UNKNOWN
apache-modinclude-bo(17785)

Source: XF
Type: UNKNOWN
apache-modinclude-bo(17785)

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073149 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html

Source: MLIST
Type: UNKNOWN
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/

Source: SUSE
Type: SUSE-SA:2004:040
samba: remote denial of service

Source: SUSE
Type: SUSE-SA:2004:041
xshared XFree86-libs xorg-x11-libs: remote system compromise

Source: SUSE
Type: SUSE-SR:2004:001
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apache:http_server:1.3.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.25:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.32:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:current:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.20:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.29:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.9:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.26:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.27:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.7:*:dev:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.31:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.2:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:hp:hp-ux:11.00:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.22:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.11:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.20:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:current:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.5:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:x86_64:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apache:http_server:1.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.19:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.26:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.9:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.12:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.20:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.23:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.17:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.14:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.11:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.27:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.28:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.29:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.33:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.37:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.0:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.39:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.36:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.35:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.34:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.32:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.31:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.24:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.22:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.18:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.25:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.10:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.13:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.15:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.16:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.30:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.38:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.7:*:*:*:*:*:*:*
  • OR cpe:/a:apache:http_server:1.3.8:*:*:*:*:*:*:*
  • AND
  • cpe:/o:hp:hp-ux:11.00:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.11:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:1.5:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.20:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:stronghold:-:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:current:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.22:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:current:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.2.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.2.8:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.3.6:*:*:*:*:*:*:*
  • OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.3.6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20040940
    V
    		CVE-2004-0940
    2015-11-16
    oval:org.debian:def:594
    V
    		buffer overflows
    2004-11-17
    BACK
    apache http server 1.3.11
    apache http server 1.3.12
    apache http server 1.3.24
    apache http server 1.3.25
    apache http server 1.3.32
    apache http server 1.3.4
    openpkg openpkg current
    apache http server 1.3.19
    apache http server 1.3.20
    apache http server 1.3.28
    apache http server 1.3.29
    apache http server 1.3.9
    openpkg openpkg 2.0
    apache http server 1.3.14
    apache http server 1.3.17
    apache http server 1.3.18
    apache http server 1.3.26
    apache http server 1.3.27
    apache http server 1.3.6
    apache http server 1.3.7
    apache http server 1.3
    apache http server 1.3.1
    apache http server 1.3.22
    apache http server 1.3.23
    apache http server 1.3.3
    apache http server 1.3.31
    openpkg openpkg 2.1
    openpkg openpkg 2.2
    hp hp-ux 11.00
    slackware slackware linux 9.0
    slackware slackware linux 9.1
    suse suse linux 9.1
    suse suse linux 9.2
    hp hp-ux 11.22
    slackware slackware linux 10.0
    suse suse linux 8.1
    suse suse linux 8.2
    hp hp-ux 11.11
    hp hp-ux 11.20
    slackware slackware linux current
    suse suse linux 8.0
    trustix secure linux 1.5
    slackware slackware linux 8.0
    slackware slackware linux 8.1
    suse suse linux 9.0
    suse suse linux 9.0
    apache http server 1.3
    apache http server 1.3.1
    apache http server 1.3.19
    apache http server 1.3.26
    apache http server 1.3.6
    apache http server 1.3.9
    apache http server 1.3.12
    apache http server 1.3.20
    apache http server 1.3.23
    apache http server 1.3.17
    apache http server 1.3.14
    apache http server 1.3.11
    apache http server 1.3.27
    apache http server 1.3.28
    apache http server 1.3.29
    apache http server 1.3.33
    apache http server 1.3.37
    apache http server 1.3.0
    apache http server 1.3.2
    apache http server 1.3.39
    apache http server 1.3.3
    apache http server 1.3.36
    apache http server 1.3.35
    apache http server 1.3.34
    apache http server 1.3.32
    apache http server 1.3.31
    apache http server 1.3.24
    apache http server 1.3.22
    apache http server 1.3.4
    apache http server 1.3.18
    apache http server 1.3.25
    apache http server 1.3.10
    apache http server 1.3.13
    apache http server 1.3.15
    apache http server 1.3.16
    apache http server 1.3.30
    apache http server 1.3.38
    apache http server 1.3.5
    apache http server 1.3.7
    apache http server 1.3.8
    hp hp-ux 11.00
    hp hp-ux 11.11
    trustix secure linux 1.5
    hp hp-ux 11.20
    debian debian linux 3.0
    redhat stronghold -
    slackware slackware linux 8.1
    openpkg openpkg current
    gentoo linux *
    hp hp-ux 11.22
    suse suse linux 8.1
    suse linux enterprise server 8
    mandrakesoft mandrake multi network firewall 8.2
    slackware slackware linux current
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    slackware slackware linux 9.0
    suse suse linux 8.2
    slackware slackware linux 9.1
    suse suse linux 9.0
    mandrakesoft mandrake linux 9.2
    openpkg openpkg 2.0
    mandrakesoft mandrake linux 10.0
    suse suse linux 9.1
    openpkg openpkg 2.1
    slackware slackware linux 10.0
    suse suse linux 9.2
    openpkg openpkg 2.2
    mandrakesoft mandrake linux 10.1
    apple mac os x 10.2.8
    apple mac os x server 10.2.8
    apple mac os x 10.3.6
    novell linux desktop 9
    redhat linux advanced workstation 2.1
    suse linux enterprise server 9
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1
    apple mac os x server 10.3.6