Vulnerabilities > CVE-2004-2680 - Unspecified vulnerability in Apache MOD Python

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
apache
nessus
NVD
Published: 2004-12-31
Updated: 2023-11-07

Summary

mod_python (libapache2-mod-python) 3.1.4 and earlier does not properly handle when output filters process more than 16384 bytes, which can cause filter.read to return portions of previously freed memory.

Vulnerable Configurations

Part Description Count
Application
Apache
30

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_APACHE2-MOD_PYTHON-4448.NASL
    descriptionThis update fixes a buffer overflow in apache2-mod_python that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. (CVE-2004-2680)
    last seen2020-06-01
    modified2020-06-02
    plugin id29879
    published2008-01-08
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29879
    titleopenSUSE 10 Security Update : apache2-mod_python (apache2-mod_python-4448)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-430-1.NASL
    descriptionMiles Egan discovered that mod_python, when used in output filter mode, did not handle output larger than 16384 bytes, and would display freed memory, possibly disclosing private data. Thanks to Jim Garrison of the Software Freedom Law Center for identifying the original bug as a security vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id28024
    published2007-11-10
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/28024
    titleUbuntu 5.10 / 6.06 LTS : libapache2-mod-python vulnerability (USN-430-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE9_11804.NASL
    descriptionThis update fixes a buffer overflow in apache2-mod_python that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. (CVE-2004-2680)
    last seen2020-06-01
    modified2020-06-02
    plugin id41153
    published2009-09-24
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/41153
    titleSuSE9 Security Update : apache2-mod_python (YOU Patch Number 11804)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_APACHE2-MOD_PYTHON-4449.NASL
    descriptionThis update fixes a buffer overflow in apache2-mod_python that occurs while using python-based output-filter. This bug can be triggered remotely to read possibly confidential data from the process space of the web-server and in rare cases to execute arbitrary code. (CVE-2004-2680)
    last seen2020-06-01
    modified2020-06-02
    plugin id29380
    published2007-12-13
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29380
    titleSuSE 10 Security Update : apache2-mod_python (ZYPP Patch Number 4449)

Statements

contributorTomas Hoger
lastmodified2009-05-21
organizationRed Hat
statementRed Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2004-2680 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/

References