CVE-2004-0700

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-07-27 · updated 2026-06-16

Description

Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.

Affected products

gentoo Linux: 1.4
Mod Ssl: 2.3.11, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4 (+37)

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000857
http://marc.info/?l=apache-modssl&m=109001100906749&w=2
http://marc.info/?l=bugtraq&m=109005001205991&w=2
http://packetstormsecurity.org/0407-advisories/modsslFormat.txt
http://virulent.siyahsapka.org/
http://www.debian.org/security/2004/dsa-532
http://www.kb.cert.org/vuls/id/303448
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:075
http://www.osvdb.org/7929
http://www.redhat.com/support/errata/RHSA-2004-405.html
http://www.redhat.com/support/errata/RHSA-2004-408.html
http://www.securityfocus.com/bid/10736

Get alerted when CVE-2004-0700 or the next vulnerability affects your stack