Description
Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.0.37 | — |
| Debian 13 | apache2 | 2.0.37 | — |
| Debian 12 | apache2 | 2.0.37 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Apache Win32 Chunked Encoding
exploit/windows/http/apache_chunked
Exploit-DB 3
- Apache (Windows x86) - Chunked Encoding (Metasploit) EDB-16782 · remote · Jul 7, 2010 · verified
- Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (1) EDB-21559 · remote · Jun 17, 2002 · verified
- Apache 1.x/2.0.x - Chunked-Encoding Memory Corruption (2) EDB-21560 · remote · Jun 17, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- RHSA-2002:150 vendor-advisory
- CA-2002-17 third-party-advisory
- RHSA-2002:118 vendor-advisory
- RHSA-2003:106 vendor-advisory
- 20005 vdb-entry
- DSA-133 vendor-advisory
- SSRT050968 vendor-advisory
- ESA-20020619-014 vendor-advisory
- http://httpd.apache.org/info/security_bulletin_20020617.txt
- SuSE-SA:2002:022 vendor-advisory
- VU#944335 third-party-advisory
- DSA-132 vendor-advisory
- HPSBTL0206-049 vendor-advisory
- 20020619 [OpenPKG-SA-2002.004] OpenPKG Security Advisory (apache) mailing-list
- HPSBUX0207-197 vendor-advisory
- 838 vdb-entry
- DSA-131 vendor-advisory
- CLSA-2002:498 vendor-advisory
- 20020621 [slackware-security] new apache/mod_ssl packages available mailing-list
- 20020621 [SECURITY] Remote exploit for 32-bit Apache HTTP Server known mailing-list
- MDKSA-2002:039 vendor-advisory
- apache-chunked-encoding-bo(9249) vdb-entry
- RHSA-2002:126 vendor-advisory
- RHSA-2002:103 vendor-advisory
- ADV-2006-3598 third-party-advisory
- 5033 vdb-entry
- RHSA-2002:117 vendor-advisory
- 21917 third-party-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [2/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list