PT-2011-3482 · Apache+1 · Apache Http Server+2

Chris · Publicado 2011-05-24 · Atualizado 2024-06-15 · CVE-2011-1928

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime (APR) library versions 1.4.3 through 1.4.4 Apache HTTP Server version 2.2.18

Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, via a URI that does not match certain types of wildcard patterns. This can be demonstrated by attacks against mod autoindex in httpd when a /*/WEB-INF/ configuration pattern is used.

Recommendations For Apache Portable Runtime (APR) library versions 1.4.3 and 1.4.4, consider updating to a version that includes a correct fix for the issue. For Apache HTTP Server version 2.2.18, consider updating to a version that includes a correct fix for the issue. As a temporary workaround, consider restricting access to the mod autoindex module in httpd to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2011-1928

DSA-2237-2

OPENSUSE-SU-2024:10063-1

OPENSUSE-SU-2024:11596-1

RHSA-2011:0844

RHSA-2011_0844

Produtos afetados

Apache Http Server

Apache Portable Runtime

Red Hat

Referências · 30

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1928 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2011-1928 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=627182 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2011:095 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-1928 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2011-0844.html · Aviso do Fabricante
• http://secunia.com/advisories/44661 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1928 · Nota
• http://secunia.com/advisories/44558 · Aviso do Fabricante
• http://secunia.com/advisories/44780 · Nota
• https://osv.dev/vulnerability/CVE-2011-1928 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11596-1 · Aviso do Fabricante
• https://issues.apache.org/bugzilla/show_bug.cgi?id=51219 · Nota
• http://mail-archives.apache.org/mod_mbox/httpd-announce/201105.mbox/%3C4DD55092.3030403%40apache.org%3E · Nota
• http://vupen.com/english/advisories/2011/1290 · Aviso do Fabricante