CVE-2005-3357
CVE-2005-3357 is a medium-severity vulnerability in Apache Http Server with a CVSS 2.0 base score of 5.4. Its EPSS exploit-prediction score of 24% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-399.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.4)
- EPSS exploit prediction: 24% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-399
- Affected product: Apache Http Server
- Published:
- Last modified:
Description
mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
Frequently asked questions
- What is CVE-2005-3357?
- mod_ssl in Apache 2.0 up to 2.0.55, when configured with an SSL vhost with access control and a custom error 400 error page, allows remote attackers to cause a denial of service (application crash) via a non-SSL request to an SSL port, which triggers a NULL pointer dereference.
- How severe is CVE-2005-3357?
- CVE-2005-3357 has a CVSS 2.0 base score of 5.4, rated medium severity.
- Is CVE-2005-3357 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 24% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2005-3357?
- CVE-2005-3357 primarily affects Apache Http Server. In total, 26 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2005-3357?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2005-3357 published?
- CVE-2005-3357 was published on 2005-12-31 and last updated on 2026-06-16.
References
- ftp://patches.sgi.com/support/free/security/advisories/20060101-01-U
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01428449
- http://issues.apache.org/bugzilla/show_bug.cgi?id=37791
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
- http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html
- http://marc.info/?l=bugtraq&m=130497311408250&w=2
- http://rhn.redhat.com/errata/RHSA-2006-0159.html
- http://secunia.com/advisories/18307
- http://secunia.com/advisories/18333
- http://secunia.com/advisories/18339
- http://secunia.com/advisories/18340
- http://secunia.com/advisories/18429
- http://secunia.com/advisories/18517
- http://secunia.com/advisories/18585
- http://secunia.com/advisories/18743
- http://secunia.com/advisories/19012
- http://secunia.com/advisories/21848
- http://secunia.com/advisories/22233
- http://secunia.com/advisories/22368
- http://secunia.com/advisories/22523
- http://secunia.com/advisories/22669
- http://secunia.com/advisories/22992
- http://secunia.com/advisories/23260
- http://secunia.com/advisories/29849
- http://secunia.com/advisories/30430
- http://securitytracker.com/id?1015447
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102640-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102662-1
- http://support.avaya.com/elmodocs2/security/ASA-2006-250.htm
- http://svn.apache.org/viewcvs?rev=358026&view=rev
Affected products (26)
- cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*
More vulnerabilities in Apache Http Server
- CVE-2010-0425 — Critical (CVSS 10.0): modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and…
- CVE-2005-2700 — Critical (CVSS 10.0): ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host…
- CVE-2004-0492 — Critical (CVSS 10.0): Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a…
- CVE-2003-0789 — Critical (CVSS 10.0): mod_cgid in Apache before 2.0.48, when using a threaded MPM, does not properly handle CGI redirect paths, which could…
- CVE-1999-1293 — Critical (CVSS 10.0): mod_proxy in Apache 1.2.5 and earlier allows remote attackers to cause a denial of service via malformed FTP commands,…
- CVE-1999-0926 — Critical (CVSS 10.0): Apache allows remote attackers to conduct a denial of service via a large number of MIME headers.
All CVEs affecting Apache Http Server →
Other CWE-399 (Resource Management Errors) vulnerabilities
- CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
- CVE-2015-0339 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
- CVE-2015-0335 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
- CVE-2015-0333 — Critical (CVSS 10.0): Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
- CVE-2014-4121 — Critical (CVSS 10.0): Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly parse internationalized…
- CVE-2014-0560 — Critical (CVSS 10.0): Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS…
Browse all CWE-399 (Resource Management Errors) vulnerabilities →