PT-2014-3476 · Apache+5 · Apache Http Server+5

Publicado 2014-03-17 · Atualizado 2024-06-15 · CVE-2014-0098

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.8

Description The issue allows remote attackers to cause a denial of service, resulting in a segmentation fault and daemon crash. This is achieved through a crafted cookie that is not properly handled during truncation, specifically targeting the log cookie function in the mod log config module.

Recommendations For versions prior to 2.4.8, update to version 2.4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod log config module until a patch is applied.

Correção

Identificadores relacionados

ALT-PU-2015-1890

CESA-2014_0370

CVE-2014-0098

HPSBUX03102

HPSBUX03150

MGASA-2014-0135

OPENSUSE-SU-2014_0969-1

OPENSUSE-SU-2024:10268-1

RHSA-2014:0369

RHSA-2014:0370

RHSA-2014:0783

RHSA-2014:0826

RHSA-2014_0369

RHSA-2014_0370

SUSE-SU-2015:0689-1

Produtos afetados

Alt Linux

Apache Http Server

Centos

Hp-Ux

Red Hat

Suse

Referências · 212

• https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08 · Nota
• https://github.com/file/file/commit/36fadd29849b8087af9f4586f89dbf74ea45be67 · Nota
• https://github.com/file/file/commit/6d209c1c489457397a5763bca4b28e43aac90391 · Nota
• https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382 · Nota
• https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259d · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/QMNVKSYSRUBBHWVTHPBJK7JVV6ED2DJK · Nota
• https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0098 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2014-3583 · Nota
• https://access.redhat.com/errata/RHSA-2014:0370 · Nota
• http://marc.info/?l=bugtraq&m=141390017113542&w=2 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• http://apache.org/dist/httpd/Announcement2.4.html · Nota