PT-1998-1170 · Apache · Apache Www Server+1

Publicado

1998-08-07

·

Atualizado

2021-06-06

·

CVE-1999-1199

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Apache WWW server versions 1.3.1 and earlier
Description The issue allows remote attackers to cause a denial of service, specifically resource exhaustion, by sending a large number of MIME headers with the same name. This problem exists because Apache uses up memory faster than the amount of memory required to simply store the received data itself, making the memory use increase at an accelerating rate as more headers are received.
Recommendations For Apache WWW server versions 1.3.1 and earlier, as a temporary workaround, consider restricting the number of headers with the same name that can be processed to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-1999-1199

Produtos afetados

Apache Http Server
Apache Www Server