Apache 'mod_ssl' Log Function Format String Vulnerability
BID:10736
Info
Apache 'mod_ssl' Log Function Format String Vulnerability
| Bugtraq ID: | 10736 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0700 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 16 2004 12:00AM |
| Updated: | Jun 30 2008 11:52PM |
| Credit: | Discovery is credited to Virulent and Ralf S. Engelschall. |
| Vulnerable: |
VMWare ESX Server 2.1.2 VMWare ESX Server 2.1.1 VMWare ESX Server 2.1 VMWare ESX Server 2.0.1 build 6403 VMWare ESX Server 2.0.1 VMWare ESX Server 2.0 build 5257 VMWare ESX Server 2.0 VMWare ESX Server 1.5.2 Redhat Network Proxy (for RHEL 4) 4.2 Redhat Network Proxy (for RHEL 3) 4.2 Redhat Linux 7.3 i686 Redhat Linux 7.3 i386 Redhat Linux 7.3 Oracle Oracle HTTP Server for Apps only 1.0.2 .1s Oracle Oracle HTTP Server 9.2 .0 Oracle Oracle HTTP Server 9.1 Oracle Oracle HTTP Server 9.0.3 .1 Oracle Oracle HTTP Server 9.0.2 .3 Oracle Oracle HTTP Server 9.0.2 Oracle Oracle HTTP Server 9.0.1 Oracle Oracle HTTP Server 8.1.7 Oracle Oracle HTTP Server 1.0.2 .2 Roll up 2 Oracle Oracle HTTP Server 1.0.2 .2 Oracle Oracle HTTP Server 1.0.2 .1 Oracle Oracle HTTP Server 1.0.2 .0 Oracle HTTP Server for Server 9.2 Oracle HTTP Server for Server 9.0.1 Oracle HTTP Server for Server 8.1.7 mod_ssl mod_ssl 2.8.18 mod_ssl mod_ssl 2.8.17 mod_ssl mod_ssl 2.8.16 mod_ssl mod_ssl 2.8.15 mod_ssl mod_ssl 2.8.14 mod_ssl mod_ssl 2.8.12 mod_ssl mod_ssl 2.8.10 mod_ssl mod_ssl 2.8.9 mod_ssl mod_ssl 2.8.8 mod_ssl mod_ssl 2.8.7 mod_ssl mod_ssl 2.8.6 mod_ssl mod_ssl 2.8.5 -2 mod_ssl mod_ssl 2.8.5 -1 mod_ssl mod_ssl 2.8.5 mod_ssl mod_ssl 2.8.4 mod_ssl mod_ssl 2.8.3 mod_ssl mod_ssl 2.8.2 mod_ssl mod_ssl 2.8.1 -2 mod_ssl mod_ssl 2.8.1 mod_ssl mod_ssl 2.8 mod_ssl mod_ssl 2.7.1 mod_ssl mod_ssl 2.7 .0 mod_ssl mod_ssl 2.6.6 mod_ssl mod_ssl 2.6.5 mod_ssl mod_ssl 2.6.4 mod_ssl mod_ssl 2.6.3 mod_ssl mod_ssl 2.6.2 mod_ssl mod_ssl 2.6.1 mod_ssl mod_ssl 2.6 .0 mod_ssl mod_ssl 2.5.1 mod_ssl mod_ssl 2.5 .0 mod_ssl mod_ssl 2.4.10 mod_ssl mod_ssl 2.4.9 mod_ssl mod_ssl 2.4.8 mod_ssl mod_ssl 2.4.7 mod_ssl mod_ssl 2.4.6 mod_ssl mod_ssl 2.4.5 mod_ssl mod_ssl 2.4.4 mod_ssl mod_ssl 2.4.3 mod_ssl mod_ssl 2.4.2 mod_ssl mod_ssl 2.4.1 mod_ssl mod_ssl 2.4 .10 mod_ssl mod_ssl 2.4 .0 mod_ssl mod_ssl 2.3.11 HP Webproxy A.02.10 HP Webproxy A.02.00 HP VirtualVault A.04.70 HP VirtualVault A.04.60 HP VirtualVault A.04.50 HP HP-UX 11.22 HP HP-UX 11.20 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX B.11.22 HP HP-UX B.11.11 HP HP-UX B.11.00 Gentoo Linux 1.4 Avaya S8700 R2.0.1 Avaya S8700 R2.0.0 Avaya S8500 R2.0.1 Avaya S8500 R2.0.0 Avaya S8300 R2.0.1 Avaya S8300 R2.0.0 Avaya Converged Communications Server 2.0 Apache Apache 2.0.50 Apache Apache 2.0.49 Apache Apache 2.0.48 Apache Apache 2.0.47 Apache Apache 2.0.46 Apache Apache 2.0.45 Apache Apache 2.0.44 Apache Apache 2.0.43 Apache Apache 2.0.42 Apache Apache 2.0.41 Apache Apache 2.0.40 Apache Apache 2.0.39 Apache Apache 2.0.38 Apache Apache 2.0.37 Apache Apache 2.0.36 Apache Apache 2.0.35 Apache Apache 2.0.32 Apache Apache 2.0.28 Beta Apache Apache 2.0.28 Apache Apache 2.0 a9 Apache Apache 2.0 |
| Not Vulnerable: |
mod_ssl mod_ssl 2.8.19 |
Discussion
Apache 'mod_ssl' Log Function Format String Vulnerability
The 'mod_ssl' module is affected by a format-string vulnerability within its logging function. This issue occurs because the application fails to properly implement a formatted-string function.
Successful exploits will most likely allow an attacker to gain control of the execution flow of the affected process and run arbitrary code on the affected computer, but this has not been confirmed.
The 'mod_ssl' module is affected by a format-string vulnerability within its logging function. This issue occurs because the application fails to properly implement a formatted-string function.
Successful exploits will most likely allow an attacker to gain control of the execution flow of the affected process and run arbitrary code on the affected computer, but this has not been confirmed.
Exploit / POC
Apache 'mod_ssl' Log Function Format String Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apache 'mod_ssl' Log Function Format String Vulnerability
Solution:
Fixes are available. Please see the references for more information.
VMWare ESX Server 2.0.1
VMWare ESX Server 2.1
VMWare ESX Server 2.1.2
mod_ssl mod_ssl 2.3.11
mod_ssl mod_ssl 2.4 .10
mod_ssl mod_ssl 2.4.10
mod_ssl mod_ssl 2.4.2
mod_ssl mod_ssl 2.4.3
mod_ssl mod_ssl 2.4.5
mod_ssl mod_ssl 2.4.6
mod_ssl mod_ssl 2.4.7
mod_ssl mod_ssl 2.4.8
mod_ssl mod_ssl 2.4.9
mod_ssl mod_ssl 2.5 .0
mod_ssl mod_ssl 2.5.1
mod_ssl mod_ssl 2.6 .0
mod_ssl mod_ssl 2.6.1
mod_ssl mod_ssl 2.6.2
mod_ssl mod_ssl 2.6.3
mod_ssl mod_ssl 2.6.5
mod_ssl mod_ssl 2.6.6
mod_ssl mod_ssl 2.7 .0
mod_ssl mod_ssl 2.7.1
mod_ssl mod_ssl 2.8.1
mod_ssl mod_ssl 2.8.1 -2
mod_ssl mod_ssl 2.8.10
mod_ssl mod_ssl 2.8.12
mod_ssl mod_ssl 2.8.15
mod_ssl mod_ssl 2.8.16
mod_ssl mod_ssl 2.8.17
mod_ssl mod_ssl 2.8.2
mod_ssl mod_ssl 2.8.3
mod_ssl mod_ssl 2.8.4
mod_ssl mod_ssl 2.8.5 -2
mod_ssl mod_ssl 2.8.6
mod_ssl mod_ssl 2.8.7
mod_ssl mod_ssl 2.8.8
mod_ssl mod_ssl 2.8.9
Solution:
Fixes are available. Please see the references for more information.
VMWare ESX Server 2.0.1
-
VMWare esx-2.0.1-11429-upgrade.tar.gz
http://vmware-svca.www.conxion.com/secured/esx/esx-2.0.1-11429-upgrade .tar.gz
VMWare ESX Server 2.1
-
VMWare esx-2.1.2-10921-upgrade.tar.gz
http://vmware-svca.www.conxion.com/secured/esx/esx-2.1.2-10921-upgrade .tar.gz
VMWare ESX Server 2.1.2
-
VMWare esx-2.1.2-10921-upgrade.tar.gz
http://vmware-svca.www.conxion.com/secured/esx/esx-2.1.2-10921-upgrade .tar.gz
mod_ssl mod_ssl 2.3.11
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4 .10
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.10
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.2
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.3
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.5
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.6
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.7
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.8
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.4.9
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.5 .0
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.5.1
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.6 .0
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.6.1
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.6.2
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.6.3
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.6.5
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.6.6
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.7 .0
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.7.1
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.1
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.1 -2
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.10
-
Mandrake mod_ssl-2.8.10-5.4.C21mdk.i586.rpm
Mandrake Corporate Server 2.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.10-5.4.C21mdk.x86_64.rpm
Mandrake Corporate Server 2.1/x86_64
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.12
-
Mandrake mod_ssl-2.8.12-8.2.91mdk.i586.rpm
Mandrake Linux 9.1
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.12-8.2.91mdk.ppc.rpm
Mandrake Linux 9.1/PPC
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz -
RedHat mod_ssl-2.8.12-6.legacy.i386.rpm
RedHat Linux 7.3
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mod_ssl-2.8.1 2-6.legacy.i386.rpm -
Slackware mod_ssl-2.8.19_1.3.31-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/m od_ssl-2.8.19_1.3.31-i386-1.tgz
mod_ssl mod_ssl 2.8.15
-
Mandrake mod_ssl-2.8.15-1.2.92mdk.amd64.rpm
Mandrake Linux 9.2/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.15-1.2.92mdk.i586.rpm
Mandrake Linux 9.2
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz -
Slackware mod_ssl-2.8.19_1.3.31-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/m od_ssl-2.8.19_1.3.31-i486-1.tgz
mod_ssl mod_ssl 2.8.16
-
Mandrake mod_ssl-2.8.16-1.2.100mdk.amd64.rpm
Mandrake Linux 10.0/AMD64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake mod_ssl-2.8.16-1.2.100mdk.i586.rpm
Mandrake Linux 10.0
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.17
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.2
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.3
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.4
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.5 -2
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.6
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.7
-
Mandrake mod_ssl-2.8.7-3.4.M82mdk.i586.rpm
Mandrake Multi Network Firewall 8.2
http://www.mandrakesecure.net/en/ftp.php -
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.8
-
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz
mod_ssl mod_ssl 2.8.9
-
Debian libapache-mod-ssl-doc_2.8.9-2.3_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl-doc_2.8.9-2.3_all.deb -
Debian libapache-mod-ssl_2.8.9-2.3_arm.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_arm.deb -
Debian libapache-mod-ssl_2.8.9-2.3_hppa.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_hppa.deb -
Debian libapache-mod-ssl_2.8.9-2.3_i386.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_i386.deb -
Debian libapache-mod-ssl_2.8.9-2.3_ia64.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_ia64.deb -
Debian libapache-mod-ssl_2.8.9-2.3_m68k.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_m68k.deb -
Debian libapache-mod-ssl_2.8.9-2.3_mips.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_mips.deb -
Debian libapache-mod-ssl_2.8.9-2.3_mipsel.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_mipsel.deb -
Debian libapache-mod-ssl_2.8.9-2.3_powerpc.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_powerpc.deb -
Debian libapache-mod-ssl_2.8.9-2.3_s390.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_s390.deb -
Debian libapache-mod-ssl_2.8.9-2.3_sparc.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl_2. 8.9-2.3_sparc.deb -
Debian libapache-mod-ssl_2.8.9-2.4_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_arm.deb -
Debian libapache-mod-ssl_2.8.9-2.4_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_hppa.deb -
Debian libapache-mod-ssl_2.8.9-2.4_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_i386.deb -
Debian libapache-mod-ssl_2.8.9-2.4_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_ia64.deb -
Debian libapache-mod-ssl_2.8.9-2.4_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_m68k.deb -
Debian libapache-mod-ssl_2.8.9-2.4_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_mips.deb -
Debian libapache-mod-ssl_2.8.9-2.4_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_mipsel.deb -
Debian libapache-mod-ssl_2.8.9-2.4_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_powerpc.deb -
Debian libapache-mod-ssl_2.8.9-2.4_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_s390.deb -
Debian libapache-mod-ssl_2.8.9-2.4_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/liba/libapache-mod-ssl/li bapache-mod-ssl_2.8.9-2.4_sparc.deb -
mod_ssl mod_ssl-2.8.19-1.3.31.tar.gz
http://www.modssl.org/source/mod_ssl-2.8.19-1.3.31.tar.gz -
Slackware mod_ssl-2.8.19_1.3.31-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/m od_ssl-2.8.19_1.3.31-i386-1.tgz
References
Apache 'mod_ssl' Log Function Format String Vulnerability
References:
References:
- Critical Patch Update - July 2005 (Oracle)
- HPSBUX01098 ApacheStrong remote Denial of Service or arbitrary code execution (HP)
- mod_ssl Homepage (mod_ssl Project)
- Project Newsflash! (mod_ssl Project)
- RHSA-2004:405-06 - Stronghold 4: New release fixes Apache, mod_ssl, and PHP (RedHat)
- RHSA-2004:408-05 - mod_ssl (RedHat)
- VMware ESX Server 1.5.2 Patch 6 Security Update (VMware)
- VMware ESX Server 2.0.1 Patch 1 Security Update (for 2.0.x systems) (VMware)
- VMware ESX Server 2.1.2 Security Update (for 2.1.x systems) (VMware)
- VU#303448 - mod_ssl contains a format string vulnerability in the ssl_log() (US-CERT)
- RHSA-2008:0523-1 Low: Red Hat Network Proxy Server security update (Red Hat)