PT-2011-4400 · Apache+2 · Apache Http Server+2
Maksymilian Arciemowicz
·
Publicado
2011-09-14
·
Atualizado
2022-09-19
·
CVE-2011-3348
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions prior to 2.2.21
Description
The issue arises when the mod proxy ajp module is used in conjunction with mod proxy balancer in specific configurations, allowing remote attackers to cause a temporary denial of service in the backend server. This can be achieved by sending certain malformed HTTP requests, which puts the backend server into an error state until the retry timeout expires.
Recommendations
For Apache HTTP Server versions prior to 2.2.21, update to version 2.2.21 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mod proxy ajp module when used with mod proxy balancer to minimize the risk of exploitation.
Exploit
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Apache Http Server
Hp-Ux
Red Hat