0

We have a Windows Server 2012 R2 running Apache 2.2.27 and Apache tomcat8 version 1.0.15.0.

Can you guys shed a few words on what the vulnerability is and also how to re-mediate this with the two versions that we are running in our environment.

1

My guess is that you referring to CVE-2004-0492 "mod_proxy in Apache 1.3.25 to 1.3.31 ... possibly execute arbitrary code via a negative Content-Length HTTP header field..." . As you can see, this bug did affect apache version 1.3.25 ... 1.3.31 but not your version 2.2.27.

  • what about the apache tomcat that i am running? Apache tomcat8 version 1.0.15.0, could the scan picked it up because of this? – gsb005 Nov 1 '16 at 20:24
  • @gsb005: Apache tomcat is unrelated to the Apache web server (where the vulnerability was) and thus is not affected. There are actually lots of Apache projects outside the web server, see projects.apache.org/projects.html?category. – Steffen Ullrich Nov 1 '16 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.