5.4
CVSSv2

CVE-2005-3357

Published: 31/12/2005 Updated: 13/02/2023
CVSS v2 Base Score: 5.4 | Impact Score: 6.9 | Exploitability Score: 4.9
VMScore: 481
Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C

Vulnerability Summary

mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote malicious users to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.

Most Upvoted Vulmon Research Post

There is no Researcher post for this vulnerability
Would you like to share something about it? Sign up now to share your knowledge with the community.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache http server 2.0.42

apache http server 2.0.47

apache http server 2.0.50

apache http server 2.0.35

apache http server 2.0.37

apache http server 2.0.55

apache http server 2.0.44

apache http server 2.0.39

apache http server 2.0.52

apache http server 2.0.53

apache http server 2.0.51

apache http server 2.0.28

apache http server 2.0.41

apache http server 2.0.49

apache http server 2.0.9

apache http server 2.0.32

apache http server 2.0.38

apache http server 2.0.48

apache http server 2.0.45

apache http server 2.0.40

apache http server 2.0.36

apache http server 2.0.46

apache http server 2.0.54

apache http server 2.0.43

apache http server 2.0

Vendor Advisories

Synopsis httpd security update Type/Severity Security Advisory: Moderate Topic Updated Apache httpd packages that correct three security issues are nowavailable for Red Hat Enterprise Linux 3 and 4This update has been rated as having moderate security impact by the RedHat Security Response Team D ...
Debian Bug report logs - #351246 apache2: [CVE-2005-3357] DoS (crash) with mod_ssl Package: apache2; Maintainer for apache2 is Debian Apache Maintainers <debian-apache@listsdebianorg>; Source for apache2 is src:apache2 (PTS, buildd, popcon) Reported by: intrigeri <intrigeri@boumorg> Date: Fri, 3 Feb 2006 14:18:50 ...
The “mod_imap” module (which provides support for image maps) did not properly escape the “referer” URL which rendered it vulnerable against a cross-site scripting attack A malicious web page (or HTML email) could trick a user into visiting a site running the vulnerable mod_imap, and employ cross-site-scripting techniques to gather sensiti ...

References

CWE-399http://issues.apache.org/bugzilla/show_bug.cgi?id=37791http://rhn.redhat.com/errata/RHSA-2006-0159.htmlhttp://www.trustix.org/errata/2005/0074/http://www.securityfocus.com/bid/16152http://secunia.com/advisories/18307http://secunia.com/advisories/18340http://securitytracker.com/id?1015447http://www.ubuntulinux.org/usn/usn-241-1http://secunia.com/advisories/18333http://secunia.com/advisories/18339http://secunia.com/advisories/18429http://www.redhat.com/archives/fedora-announce-list/2006-January/msg00060.htmlhttp://secunia.com/advisories/18585ftp://patches.sgi.com/support/free/security/advisories/20060101-01-Uhttp://secunia.com/advisories/18517http://www.gentoo.org/security/en/glsa/glsa-200602-03.xmlhttp://secunia.com/advisories/18743http://svn.apache.org/viewcvs?rev=358026&view=revhttp://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.htmlhttp://secunia.com/advisories/19012http://secunia.com/advisories/21848http://sunsolve.sun.com/search/document.do?assetkey=1-26-102640-1http://secunia.com/advisories/22233http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1http://secunia.com/advisories/22368http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117http://secunia.com/advisories/22523http://secunia.com/advisories/22669http://secunia.com/advisories/23260http://support.avaya.com/elmodocs2/security/ASA-2006-250.htmhttp://secunia.com/advisories/22992http://secunia.com/advisories/29849http://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlhttp://www.us-cert.gov/cas/techalerts/TA08-150A.htmlhttp://secunia.com/advisories/30430http://www.vupen.com/english/advisories/2006/3995http://www.vupen.com/english/advisories/2006/4300http://www.vupen.com/english/advisories/2008/1697http://www.vupen.com/english/advisories/2006/4207http://www.vupen.com/english/advisories/2006/4868http://www.vupen.com/english/advisories/2008/1246/referenceshttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449http://www.vupen.com/english/advisories/2006/0056http://www.vupen.com/english/advisories/2006/3920http://marc.info/?l=bugtraq&m=130497311408250&w=2https://lists.opensuse.org/opensuse-security-announce/2006-09/msg00016.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11467http://www.securityfocus.com/archive/1/450315/100/0/threadedhttp://www.securityfocus.com/archive/1/445206/100/0/threadedhttp://www.securityfocus.com/archive/1/425399/100/0/threadedhttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/reb542d2038e9c331506e0cbff881b47e40fbe2bd93ff00979e60cdf7%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rafd145ba6cd0a4ced113a5823cdaff45aeb36eb09855b216401c66d6%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r652fc951306cdeca5a276e2021a34878a76695a9f3cfb6490b4a6840%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5f9c22f9c28adbd9f00556059edc7b03a5d5bb71d4bb80257c0d34e4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb9c9f42dafa25d2f669dac2a536a03f2575bc5ec1be6f480618aee10%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3Ehttps://access.redhat.com/errata/RHSA-2006:0159https://usn.ubuntu.com/241-1/https://nvd.nist.govhttps://www.securityfocus.com/bid/16152