CVE-2002-1850

moderate-risk

Published 2002-12-31

mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.

Do I need to act?

2.9% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

21854

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (2)

Http Server

Affected Vendors

Apache

References (18)

Broken Link http://cvs.apache.org/viewcvs.cgi/httpd-2.0/modules/generators/mod_cgi.c?r1=1.14...

Issue Tracking http://issues.apache.org/bugzilla/show_bug.cgi?id=10515

Issue Tracking http://issues.apache.org/bugzilla/show_bug.cgi?id=22030

Mailing List http://marc.info/?l=apache-httpd-dev&m=103291952019514&w=2

Exploit http://seclists.org/bugtraq/2002/Sep/0253.html

Broken Link http://securitytracker.com/id?1007823

Broken Link http://www.iss.net/security_center/static/10200.php

Broken Link http://www.securityfocus.com/bid/5787

Broken Link http://www.securityfocus.com/bid/8725