FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Apache 1.3 IP address access control failure on some 64-bit platforms

Affected packages
apache < 1.3.29_2
apache+mod_ssl < 1.3.29+2.8.16_1
apache+ssl < 1.3.29.1.53_1
ru-apache < 1.3.29+30.19_1
ru-apache+mod_ssl < 1.3.29+30.19+2.8.16_1

Details

VuXML ID 09d418db-70fd-11d8-873f-0020ed76ef5a
Discovery 2004-03-07
Entry 2004-03-08
Modified 2004-03-12

Henning Brauer discovered a programming error in Apache 1.3's mod_access that results in the netmasks in IP address access control rules being interpreted incorrectly on 64-bit, big-endian platforms. In some cases, this could cause a `deny from' IP address access control rule including a netmask to fail.

References

Bugtraq ID 9829
CVE Name CVE-2003-0993
Message http://marc.theaimsgroup.com/?l=apache-cvs&m=107869603013722
URL http://cvs.apache.org/viewcvs.cgi/apache-1.3/src/modules/standard/mod_access.c?r1=1.46&r2=1.47
URL http://nagoya.apache.org/bugzilla/show_bug.cgi?id=23850
URL http://www.apacheweek.com/features/security-13