CVE-2004-0885: High severity apache http server vulnerability
Published Oct 16, 2004
·Updated
The modssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
Affected Software
18 affected components
Apache HTTP Server=2.0.42
Apache HTTP Server=2.0.47
Apache HTTP Server=2.0.50
Apache HTTP Server=2.0.35
Apache HTTP Server=2.0.37
Apache HTTP Server=2.0.44
Apache HTTP Server=2.0.39
Apache HTTP Server=2.0.52
Apache HTTP Server=2.0.51
Apache HTTP Server=2.0.41
Apache HTTP Server=2.0.49
Apache HTTP Server=2.0.38
Apache HTTP Server=2.0.48
Apache HTTP Server=2.0.45
Apache HTTP Server=2.0.40
Apache HTTP Server=2.0.36
Apache HTTP Server=2.0.46
Apache HTTP Server=2.0.43
Remediation
Patch Available
Event History
Oct 16, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0885?
CVE-2004-0885 has a medium severity rating, allowing remote clients to bypass SSL cipher restrictions.
2
How do I fix CVE-2004-0885?
To fix CVE-2004-0885, update Apache HTTP Server to a version later than 2.0.52.
3
What versions are affected by CVE-2004-0885?
Versions of Apache HTTP Server ranging from 2.0.35 to 2.0.52 are affected by CVE-2004-0885.
4
Is CVE-2004-0885 a remote exploitation vulnerability?
Yes, CVE-2004-0885 allows remote exploitation due to improper handling of the SSLCipherSuite directive.
5
What impact does CVE-2004-0885 have on secure connections?
CVE-2004-0885 can potentially weaken the security of SSL connections by enabling unauthorized cipher suite usage.