PT-1998-1170 · Apache · Apache Www Server+1
Published
1998-08-07
·
Updated
2021-06-06
·
CVE-1999-1199
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache WWW server versions 1.3.1 and earlier
Description
The issue allows remote attackers to cause a denial of service, specifically resource exhaustion, by sending a large number of MIME headers with the same name. This problem exists because Apache uses up memory faster than the amount of memory required to simply store the received data itself, making the memory use increase at an accelerating rate as more headers are received.
Recommendations
For Apache WWW server versions 1.3.1 and earlier, as a temporary workaround, consider restricting the number of headers with the same name that can be processed to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Http Server
Apache Www Server