PT-2014-3115 · Apache+5 · Apache Http Server+5

Amin Tora + 1 · Publicado 2014-03-17 · Atualizado 2024-06-15 · CVE-2013-6438

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.8

Description The issue arises from the dav xml get cdata function in the mod dav module, which fails to properly remove whitespace characters from CDATA sections. This allows remote attackers to cause a denial of service (daemon crash) by sending a crafted DAV WRITE request.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod dav module until a patch is applied.

Correção

Identificadores relacionados

ALT-PU-2015-1890

CESA-2014_0370

CVE-2013-6438

DLA-66-1

HPSBUX03102

HPSBUX03150

MGASA-2014-0135

OPENSUSE-SU-2014_0969-1

OPENSUSE-SU-2024:10268-1

RHSA-2014:0369

RHSA-2014:0370

RHSA-2014:0783

RHSA-2014:0826

RHSA-2014_0369

RHSA-2014_0370

SUSE-SU-2014_0967-1

SUSE-SU-2014_1080-1

SUSE-SU-2014_1081-1

SUSE-SU-2015:0689-1

Produtos afetados

Alt Linux

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

Referências · 214

• https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08 · Nota
• https://github.com/file/file/commit/36fadd29849b8087af9f4586f89dbf74ea45be67 · Nota
• https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391 · Nota
• https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382 · Nota
• https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259d · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QMNVKSYSRUBBHWVTHPBJK7JVV6ED2DJK · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2013-6438 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2014-3583 · Nota
• https://access.redhat.com/errata/RHSA-2014:0370 · Nota
• http://marc.info/?l=bugtraq&m=141390017113542&w=2 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota