PT-2009-4352 · Apache+1 · Apache Http Server+1

Publicado

2009-07-02

·

Atualizado

2024-06-15

·

CVE-2009-1890

CVSS v2.0

7.1

Alta

VetorAV:N/AC:M/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.3.3
Description: The issue is related to the stream reqbody cl function in the mod proxy module, which does not properly handle streamed data that exceeds the Content-Length value when a reverse proxy is configured. This allows remote attackers to cause a denial of service by consuming CPU time via crafted requests.
Recommendations: For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mod proxy module when it is used as a reverse proxy until a patch is available.

Correção

DoS

Resource Exhaustion

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2009-1890
DSA-1834-1
HPSBUX02612
OPENSUSE-SU-2024:10268-1
RHSA-2009:1148
RHSA-2009:1155
RHSA-2009:1156
RHSA-2009:1160
RHSA-2009_1148

Produtos afetados

Apache Http Server
Red Hat