CVE-2004-0751

Vulnerability

A segmentation fault occurs in the char_buffer_read function within the mod_ssl module of Apache HTTP Server 2.x. This vulnerability is triggered when Apache is configured for reverse proxying to an SSL server. The issue affects Apache 2.x versions prior to 2.0.51 [1][2].

Exploitation

An attacker does not require authentication or local access. By sending a specially crafted request to a server that is acting as a reverse proxy to an SSL backend, the attacker can cause the char_buffer_read function to dereference a null or invalid pointer, leading to a segmentation fault. No user interaction is needed beyond the network request [2][3].

Impact

Successful exploitation results in a denial of service (DoS) by crashing the Apache child process handling the request. This can lead to service disruption for legitimate users. The vulnerability does not allow code execution or privilege escalation [1][2].

Mitigation

The fix is included in Apache HTTP Server 2.0.51 and later [2]. Users are advised to upgrade to at least version 2.0.51. No known workaround exists for unpatched versions [2]. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.