Executive brief
A vulnerability exists in older versions of the Apache HTTP Server, which is the software used to host and serve websites. By sending a specially crafted web cookie, an attacker could potentially crash the server or gain unauthorized access to the system. This could lead to a disruption of web services or the compromise of sensitive data stored on the server.
Technical details
A buffer overflow vulnerability exists in Apache httpd versions 1.1.1 and earlier. The flaw is located in the handling of HTTP cookies, where insufficient bounds checking on cookie data allows for a memory corruption event. A remote, unauthenticated attacker can exploit this by sending a malicious HTTP request containing an oversized or specially crafted cookie. Successful exploitation could lead to arbitrary code execution or a denial-of-service (DoS) condition. This issue was addressed in subsequent releases of the Apache server.
Affected products
- Apache httpd 1.1.1 and earlier
Timeline
- 1997-09-01: disclosed