Two vulnerabilities have been reported in Apache, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a system, or by malicious, local users to gain escalated privileges.

1) An input validation error within the apr-util library's IPv6 URI parsing functionality can be exploited via a specially crafted request.

Successful exploitation crashes a httpd child process. However, it is reportedly believed that the vulnerability may allow code execution on BSD systems.

The vulnerability affects versions 2.0.35 through 2.0.50.

2) A boundary error within the expansion of environment variables when parsing configuration files can be exploited to cause a buffer overflow via a specially crafted ".htaccess" file.

Successful exploitation may allow a malicious, local user to gain escalated privileges.

The vulnerability affects versions 2.0.35 through 2.0.50.

Solution
Apply patches or update to version 2.0.51.
Further details available in Customer Area

Provided and/or discovered by
1) Reported by vendor.
2) Swedish IT Incident Centre

Changelog
Further details available in Customer Area

Original Advisory
NISCC:
http://www.uniras.gov.uk/vuls/2004/403518/index.htm

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area