PT-2014-1433 · Apache+3 · Apache Http Server+3

Publicado 2014-07-15 · Atualizado 2024-06-15 · CVE-2014-0117

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.6 through 2.4.9

Description The issue allows remote attackers to cause a denial of service, resulting in the child process crashing when a specially crafted HTTP Connection header is sent to a server configured as a reverse proxy. This could lead to a denial of service against a threaded MPM.

Recommendations For Apache HTTP Server versions 2.4.6 through 2.4.9, update to version 2.4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod proxy module until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-00395

CESA-2014_0921

CVE-2014-0117

MGASA-2014-0305

OPENSUSE-SU-2024:10268-1

RHSA-2014:0921

RHSA-2014:0922

RHSA-2014_0921

USN-2299-1

ZDI-14-239

Produtos afetados

Apache Http Server

Centos

Red Hat

Ubuntu

Referências · 114

• https://ubuntu.com/security/CVE-2014-0226 · Aviso do Fabricante
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2009-3095 · Nota
• https://suse.com/security/cve/CVE-2014-3583 · Nota
• https://rhn.redhat.com/errata/RHSA-2014-0921.html · Nota
• https://suse.com/security/cve/CVE-2014-0118 · Nota
• http://httpd.apache.org/security/vulnerabilities_24.html · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1120599 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0231 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://bdu.fstec.ru/vul/2015-00398 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-0117 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-3368 · Nota
• https://ubuntu.com/security/notices/USN-2299-1 · Aviso do Fabricante