CVE:CVE-2004-0492
CNNVD:CNNVD-200408-092
mod_proxy是一个可在Apache使用的代理模块。mod_proxy在处理负的Content-Length值时存在问题，远程攻击者可以利用这个漏洞进行缓冲区溢出攻击，可能以Apache进程权限在系统上执行任意指令。连接远程服务器使其返回非法(负值)的Content-Length，可使Mod_proxy触发基于整数的溢出，会导致Apache子进程崩溃。问题存在于proxy_util.c中：n = ap_bread(f， buf， MIN((int)buf_size，(int)(len - total_bytes_rcvd)));这里len可为负值。                          在旧的OpenBSD/FreeBSD系统中可利用memcpy的反向拷贝实现来执行任意指令。新的BSD系统中由于攻击者可以控制3个任意字节也能用于执行任意指令。如果define AP_ENABLE_EXCEPTION_HOOK启用的情况下，可能在任何平台都可被利用。
solution:Upgrade apache http_server to a higher version than 1.3.26,1.3.27,1.3.28,1.3.29,1.3.31,and avoid the version 1.3.26,1.3.27,1.3.28,1.3.29,1.3.31; Upgrade hp virtualvault to a higher version than 11.0.4,and avoid the version 11.0.4; Upgrade hp webproxy to a higher version than 2.0,2.1,and avoid the version 2.0,2.1; Upgrade ibm http_server to a higher version than 1.3.26,1.3.26.1,1.3.26.2,1.3.28,and avoid the version 1.3.26,1.3.26.1,1.3.26.2,1.3.28; Upgrade sgi propack to a higher version than 2.4,and avoid the version 2.4; Upgrade hp vvos to a higher version than 11.04,and avoid the version 11.04; Upgrade openbsd openbsd to a higher version than *,3.4,3.5,and avoid the version 3.4,3.5