CVE-2010-3872: Httpd: mod_fcgid: stack-based buffer overflow in fcgid_header_bucket_read() in modules/fcgid/fcgid_bucket.c
A flaw was found in the modfcgid module of httpd. A malformed FastCGI response may result in a stack-based buffer overflow in the modules/fcgid/fcgidbucket.c file in the fcgidheaderbucketread() function, resulting in an application crash.
Other sources
The fcgidheaderbucketread function in fcgidbucket.c in the modfcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3872?
CVE-2010-3872 has a high severity rating due to its potential to cause application crashes due to a buffer overflow.
How do I fix CVE-2010-3872?
To fix CVE-2010-3872, upgrade to mod_fcgid version 2.3.6 or later.
Which versions of mod_fcgid are affected by CVE-2010-3872?
CVE-2010-3872 affects mod_fcgid versions 2.3.1 through 2.3.5.
What type of vulnerability is CVE-2010-3872?
CVE-2010-3872 is a stack-based buffer overflow vulnerability.
What component of Apache is impacted by CVE-2010-3872?
CVE-2010-3872 impacts the mod_fcgid module of the Apache HTTP server.