CVE-2004-0096

Denial of service in mod_python 2.7.9 (CAN-2003-0973 variant)

• CVSS 5.0
• CWE-400: Uncontrolled Resource Consumption
• Resource Management
• Remote

Unknown vulnerability in mod_python 2.7.9 allows remote attackers to cause a denial of service (httpd crash) via a certain query string, a variant of CAN-2003-0973.

CVE

CVE-2004-0096

CWE

CWE-400: Uncontrolled Resource Consumption

CVSS base score

5.0

Published

2004-03-03

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update mod_python to version 3.5.0 or higher

from mod_python import apache

def handler(req):
    query_string = req.args

    req.write("Processing query string: " + query_string)

    return apache.OK

from mod_python import apache

def handler(req):
    try:
        query_string = req.args
        if not is_valid_query_string(query_string):
            raise ValueError("Invalid query string")

        req.write("Query string processed successfully.")
    except Exception as e:
        req.log_error(f"Error processing request: {str(e)}")
        req.status = apache.HTTP_INTERNAL_SERVER_ERROR
        req.write("Internal Server Error")
        return apache.DONE

    return apache.OK

def is_valid_query_string(query_string):
    if len(query_string) > 1000:
        return False
    return True

@misc{vaitp:cve20040096,
  title        = {{Denial of service in mod_python 2.7.9 (CAN-2003-0973 variant)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2004},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2004-0096},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2004-0096/}}
}