{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Serveur HTTP Apache 2.0.x versions 2.0.47 et ant\u00e9rieures ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    },
    {
      "description": "Serveur HTTP Apache 1.3.x versions 1.3.28 et ant\u00e9rieures.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apache",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nDes vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes sur le module mod_cgid d\u0027une\npart, et sur les modules mod_alias et mod_rewrite d\u0027autre part.  \n\nLe module mod_cgid ne traite pas correctement les sockets de type\nAF_UNIX qui sont utilis\u00e9es pour la communication entre le d\u00e9mon cgid et\nle script CGI. La sortie du script CGI risque alors d\u0027\u00eatre envoy\u00e9e au\nmauvais client.\n\nCette vuln\u00e9rabilit\u00e9 n\u0027affecte que les versions 2.0.x du serveur HTTP\nApache.  \n\nLes modules mod_alias et mod_rewrite pr\u00e9sentent des vuln\u00e9rabilit\u00e9s de\ntype d\u00e9bordement de m\u00e9moire dans certains cas de configuration\nd\u0027expressions r\u00e9guli\u00e8res.\n\n## Solution\n\nMettre \u00e0 jour le serveur HTTP Apache en version 2.0.48 ou 1.3.29.\n",
  "cves": [],
  "initial_release_date": "2003-10-30T00:00:00",
  "last_revision_date": "2004-02-23T00:00:00",
  "links": [
    {
      "title": "Site du serveur HTTP Apache :",
      "url": "http://httpd.apache.org"
    }
  ],
  "reference": "CERTA-2003-AVI-177",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-10-30T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence \u00e0 l\u0027avis de s\u00e9curit\u00e9 Gentoo.",
      "revision_date": "2003-11-21T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences aux avis de s\u00e9curit\u00e9 de Mandrake, RedHat et HP.",
      "revision_date": "2003-12-17T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence \u00e0 la mise-\u00e0-jour 2004-01-26 d\u0027Apple.",
      "revision_date": "2004-01-29T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 de Sun.",
      "revision_date": "2004-02-12T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence \u00e0 un avis HP (HPSBUX0401-305).",
      "revision_date": "2004-02-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Divulgation d\u0027informations"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans certains modules du serveur\nHTTP Apache.\n",
  "title": "Vuln\u00e9rabilit\u00e9s du serveur HTTP Apache",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 Apache",
      "url": null
    }
  ]
}