IBM HTTP Server Can Be Crashed By Remote Users Sending Specially Crafted SSL Packets
|
|
SecurityTracker Alert ID: 1009945
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 26 2004
|
Impact: Denial of service via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 1.3.12.x, 1.3.19.x, 1.3.26.x, 1.3.28, 2.0.42.x, 2.0.47
|
Description: A vulnerability was reported in the IBM HTTP Server in the processing of SSL packets. A remote user can cause denial of service conditions.
The vendor reported that a remote user can send specially crafted SSL packets to trigger a flaw in the underlying IBM Global Security
Toolkit (GSKIT) component of the web server. A remote user can cause the web server application's performance to degrade severely
or cause the web service to crash.
All IBM products that require the IBM Global Security Toolkit (GSKIT) for SSL run-time support
are affected, the report said. GSKIT versions prior to 4.0.3.345, 5.0.5.92, 6.0.6.33, and 7.0.1.16 are reportedly vulnerable.
|
Impact: A remote user can cause the web service to degrade or crash.
|
Solution: The vendor has issued fixes for the IBM HTTP Server in APAR PQ86671 (for IBM HTTP Server Versions 1.3.x) and APAR PQ85834 (for IBM
HTTP Server Versions 2.0.x), available at:
PQ86671:
http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg24006718
PQ85834:
http://www.ibm.com/s
upport/docview.wss?rs=177&context=SSEQTJ&uid=swg24006719
|
Vendor URL: www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21165486&loc=en_US (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
