CVE-2004-0113: Medium severity Apache HTTP Server vulnerability
Published Mar 29, 2004
·Updated
Memory leak in sslengineio.c for modssl in Apache 2 before 2.0.49 allows remote attackers to cause a denial of service (memory consumption) via plain HTTP requests to the SSL port of an SSL-enabled server.
Affected Software
14 affected components
Apache HTTP Server=2.0.35
Apache HTTP Server=2.0.36
Apache HTTP Server=2.0.37
Apache HTTP Server=2.0.38
Apache HTTP Server=2.0.39
Apache HTTP Server=2.0.40
Apache HTTP Server=2.0.41
Apache HTTP Server=2.0.42
Apache HTTP Server=2.0.43
Apache HTTP Server=2.0.44
Apache HTTP Server=2.0.45
Apache HTTP Server=2.0.46
Apache HTTP Server=2.0.47
Apache HTTP Server=2.0.48
Remediation
Patch Available
Event History
Mar 29, 2004
CVE Published
05:00 AM
Sep 1, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0113?
CVE-2004-0113 is classified as a denial of service vulnerability due to memory consumption.
2
How do I fix CVE-2004-0113?
To fix CVE-2004-0113, upgrade to Apache HTTP Server version 2.0.49 or later.
3
What versions of Apache are affected by CVE-2004-0113?
CVE-2004-0113 affects Apache HTTP Server versions 2.0.35 through 2.0.48.
4
What kind of attack does CVE-2004-0113 enable?
CVE-2004-0113 enables remote attackers to exhaust memory resources, causing a denial of service.
5
Is CVE-2004-0113 exploitable remotely?
Yes, CVE-2004-0113 can be exploited remotely through plain HTTP requests to the SSL port.