Search for vulnerabilities
| Vulnerability ID | VCID-jz2v-4k62-aaac |
| Aliases |
CVE-2002-0392
|
| Summary | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 7.0 |
| Risk | 10.0 |
| Affected and Fixed Packages | Package Details |
| There are no known CWE. |
| Data source | Exploit-DB |
|---|---|
| Date added | July 7, 2010 |
| Description | Apache (Windows x86) - Chunked Encoding (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | July 7, 2010 |
| Exploit type | remote |
| Platform | windows_x86 |
| Source update date | Dec. 19, 2016 |
| Data source | Metasploit |
|---|---|
| Description | This module exploits the chunked transfer integer wrap vulnerability in Apache version 1.2.x to 1.3.24. This particular module has been tested with all versions of the official Win32 build between 1.3.9 and 1.3.24. Additionally, it should work against most co-branded and bundled versions of Apache (Oracle 8i, 9i, IBM HTTPD, etc). You will need to use the Check() functionality to determine the exact target version prior to launching the exploit. The version of Apache bundled with Oracle 8.1.7 will not automatically restart, so if you use the wrong target value, the server will crash. |
| Note | {}
|
| Ransomware campaign use | Unknown |
| Source publication date | June 19, 2002 |
| Platform | Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/windows/http/apache_chunked.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.97735 |
| EPSS Score | 0.53136 |
| Published At | March 28, 2025, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| There are no relevant records. | ||||