NVD

Id
79841  
Name
CVE-2002-0842  
Description
Format string vulnerability in certain third party modifications to mod_dav for logging bad gateway messages (e.g. Oracle9i Application Server 9.0.2) allows remote attackers to execute arbitrary code via a destination URI that forces a "502 Bad Gateway" response, which causes the format string specifiers to be returned from dav_lookup_uri() in mod_dav.c, which is then used in a call to ap_log_rerror().  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-05  
Published
2003-03-03  
Modified Date
2016-10-17  
Seq
2002-0842  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
398212 79841 CVE-2002-0842 20030217 Oracle9i Application Server Format String Vulnerability (#NISR16022003d)  View
398213 79841 CVE-2002-0842 20030217 Oracle9i Application Server Format String Vulnerability (#NISR16022003d)  View
398214 79841 CVE-2002-0842 20030218 CSSA-2003-007.0 Advisory withdrawn. Re: Security Update: [CSSA-2003-007.0] Linux: Apache mod_dav mo  View
398215 79841 CVE-2002-0842 20030218 Re: CSSA-2003-007.0 Advisory withdrawn.  View
398216 79841 CVE-2002-0842 http://otn.oracle.com/deploy/security/pdf/2003alert52.pdf  View
398217 79841 CVE-2002-0842 CA-2003-05  View
398218 79841 CVE-2002-0842 N-046  View
398219 79841 CVE-2002-0842 oracle-appserver-davpublic-dos(11330)  View
398220 79841 CVE-2002-0842 VU#849993  View
398221 79841 CVE-2002-0842 http://www.nextgenss.com/advisories/ora-appservfmtst.txt  View
398222 79841 CVE-2002-0842 6846  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
63306 JVNDB-2003-000032 複数のベンダ製品のログ採取機能におけるサービス運用妨害 (DoS) の脆弱性 mod_dav のログ採取機能には、printf() 関数、および同等の機能を持つ関数が適切に利用されていないため、フォーマットストリングの脆弱性が存在します。 CVE-2002-0842 5232 CVE-2002-0842 79841 7.5 http://jvndb.jvn.jp/ja/contents/2003/JVNDB-2003-000032.html 2003-02-11 2007-07-06 View