PT-2012-3111 · Apache · Mod Fcgid+1

Daniel Kahn Gillmor · Publicado 2012-03-19 · Atualizado 2017-08-29 · CVE-2012-1181

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions mod fcgid module version 2.3.6 for the Apache HTTP Server

Description The issue allows remote attackers to cause a denial of service, specifically memory consumption, by sending a series of HTTP requests. This is due to the mod fcgid module not recognizing the FcgidMaxProcessesPerClass directive for a virtual host, leading to a process count higher than the intended limit.

Recommendations For mod fcgid module version 2.3.6, consider disabling the module or restricting its use until a patch is available to prevent remote attackers from causing a denial of service.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2012-1181

DSA-2436-1

Produtos afetados

Apache Http Server

Mod Fcgid

Referências · 12

• http://openwall.com/lists/oss-security/2012/03/16/2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1181 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1181 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1181 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74181 · Nota
• https://osv.dev/vulnerability/CVE-2012-1181 · Aviso do Fabricante
• http://debian.org/security/2012/dsa-2436 · Aviso do Fabricante
• https://issues.apache.org/bugzilla/show_bug.cgi?id=49902 · Correção
• http://securityfocus.com/bid/52565 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-1181 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814 · Nota
• http://openwall.com/lists/oss-security/2012/03/15/10 · Nota