CVE:CVE-2004-0493
CNNVD:CNNVD-200408-043
Apache是一款开放源代码流行的Web服务程序。Apache ap_escape_html内存分配存在问题，远程攻击者可以利用这个漏洞对Apache服务程序进行拒绝服务攻击。问题存在于server/protocol.c ap_get_mime_headers_core:------      if (last_field != NULL) {            if ((len > 0) && ((*field == '	') || *field == ' ')) {...fold_buf = (char *)apr_palloc(r->pool， alloc_len);-----如果头字段以TAB或SPACE开始，Apache就会分配内存给它。而在ap_escape_html(r->pool， last_field)函数中，last_field字段可以任意长，根据如下代码：----int i， j;for (i = 0， j = 0; s[i] != ''; i++)        if (s[i] == '<' || s[i] == '>')            j += 3;        else if (s[i] == '&')            j += 4;    if (j == 0)        return apr_pstrmemdup(p， s， i);    x = apr_palloc(p， i + j + 1);----(i + j + 1)也可以是任意长度，导致分配任意内存，可消耗大量资源。在linux x86_64上证实发送820MB数据可以溢出(i+j+1)，导致memcpy崩溃而引起拒绝服务。
solution:Upgrade avaya converged_communications_server to a higher version than 2.0,and avoid the version 2.0; Upgrade gentoo linux to a higher version than 1.4,and avoid the version 1.4; Upgrade trustix secure_linux to a higher version than 1.5,2.0,2.1,and avoid the version 1.5,2.0,2.1; Upgrade apache http_server to a higher version than 2.0.47,2.0.48,2.0.49,and avoid the version 2.0.47,2.0.48,2.0.49; Upgrade ibm http_server to a higher version than 2.0.42,2.0.42.1,2.0.42.2,2.0.47,2.0.47.1,and avoid the version 2.0.42,2.0.42.1,2.0.42.2,2.0.47,2.0.47.1; Upgrade avaya s8300 to a higher version than r2.0.0,and avoid the version r2.0.0; Upgrade avaya s8500 to a higher version than r2.0.0,and avoid the version r2.0.0; Upgrade avaya s8700 to a higher version than r2.0.0,and avoid the version r2.0.0