CVE-2002-0843

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 21.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-10-11 · updated 2026-06-16

Description

Buffer overflows in the ApacheBench benchmark support program (ab.c) in Apache before 1.3.27, and Apache 2.x before 2.0.43, allow a malicious web server to cause a denial of service and possibly execute arbitrary code via a long response.

Affected products

Apache HTTP Server: 1.3, 1.3.1, 1.3.3, 1.3.4, 1.3.6, 1.3.9 (+12)
Oracle Application Server: 1.0.2, 1.0.2.1s, 1.0.2.2, 9.0.2, 9.0.2-r2, 9.0.2.1
Oracle Database: 8.1.7, 9.2.2
Oracle8I: 8.1.7, 8.1.7.0.0_enterprise, 8.1.7.1, 8.1.7.1.0_enterprise

References

http://archives.neohapsis.com/archives/bugtraq/2002-10/0229.html
http://archives.neohapsis.com/archives/bugtraq/2002-10/0254.html
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000530
http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000530
http://marc.info/?l=apache-httpd-announce&m=103367938230488&w=2
http://marc.info/?l=bugtraq&m=103376585508776&w=2
http://online.securityfocus.com/advisories/4617
http://secunia.com/advisories/21425
http://www-1.ibm.com/support/search.wss?rs=0&q=IY87070&apar=only
http://www.apacheweek.com/issues/02-10-04
http://www.debian.org/security/2002/dsa-187

Get alerted when CVE-2002-0843 or the next vulnerability affects your stack