Description
The rotatelogs program on Apache before 1.3.28, for Windows and OS/2 systems, does not properly ignore certain control characters that are received over the pipe, which could allow remote attackers to cause a denial of service.
Product(s):
- Apache HTTP Server
- Apache Software Foundation Apache HTTP Server
- Apache Software Foundation Apache HTTP Server 0.8.11
- Apache Software Foundation Apache HTTP Server 0.8.14
- Apache Software Foundation Apache HTTP Server 1.0.2
- Apache Software Foundation Apache HTTP Server 1.0.3
- Apache Software Foundation Apache HTTP Server 1.0.5
- Apache Software Foundation Apache HTTP Server 1.0
- Apache Software Foundation Apache HTTP Server 1.1.1
- Apache Software Foundation Apache HTTP Server 1.1
- Apache Software Foundation HTTP Server 1.2.0
- Apache Software Foundation Apache HTTP Server 1.2.1
- Apache Software Foundation Apache HTTP Server 1.2.2
- Apache Software Foundation Apache HTTP Server 1.2.4
- Apache Software Foundation Apache HTTP Server 1.2.5
- Apache Software Foundation Apache HTTP Server 1.2.6
- Apache Software Foundation Apache 1.29
- Apache Software Foundation Apache 1.2
- Apache Software Foundation Apache HTTP Server 1.3.0
- Apache Software Foundation Apache HTTP Server 1.3.1.1
- Apache Software Foundation Apache 1.3.10
- Apache Software Foundation Apache HTTP Server 1.3.11
- Apache Software Foundation Apache HTTP Server 1.3.12
- Apache Software Foundation Apache 1.3.13
- Apache Software Foundation Apache HTTP Server 1.3.14
- Apache Software Foundation Apache 1.3.15
- Apache Software Foundation Apache 1.3.16
- Apache Software Foundation Apache HTTP Server 1.3.17
- Apache Software Foundation Apache HTTP Server 1.3.18
- Apache Software Foundation Apache HTTP Server 1.3.19
- Apache Software Foundation Apache HTTP Server 1.3.1
- Apache Software Foundation Apache HTTP Server 1.3.20
- Apache Software Foundation Apache HTTP Server 1.3.22
- Apache Software Foundation Apache HTTP Server 1.3.23
- Apache Software Foundation Apache HTTP Server 1.3.24
- Apache Software Foundation Apache HTTP Server 1.3.25
- Apache Software Foundation Apache HTTP Server 1.3.26
- Apache Software Foundation Apache HTTP Server 1.3.27
- Apache Software Foundation Apache HTTP Server 1.3.2
- Apache Software Foundation Apache HTTP Server 1.3.3
- Apache Software Foundation Apache HTTP Server 1.3.4
- Apache Software Foundation Apache HTTP Server 1.3.5
- Apache Software Foundation Apache HTTP Server 1.3.6
- Apache Software Foundation Apache HTTP Server 1.3.7
- Apache Software Foundation Apache HTTP Server 1.3.8
- Apache Software Foundation Apache HTTP Server 1.3.9
- Apache Software Foundation Apache HTTP Server 1.3
Question to Ask Vendors:
- Can you confirm whether your systems are affected by CVE-2003-0460, and if so, what steps are you currently taking to mitigate this vulnerability?
- What is your estimated timeline for fully resolving CVE-2003-0460 in your products or services, and how will you communicate updates on this issue to us as your customer?
Recommended Actions:
- Check out the advisory links provided below.