PT-2006-1096 · Apache+10 · Apache Http Server+10
Alex Nichols
+1
·
Published
2006-10-31
·
Updated
2025-03-17
·
CVE-2006-20001
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Apache HTTP Server versions 2.4.54 and earlier
Description:
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. The issue is also related to a buffer overflow in the mod dav module, which can allow a remote attacker to cause a denial of service.
Recommendations:
For Apache HTTP Server versions 2.4.54 and earlier, update to a version later than 2.4.54 to resolve the issue. As a temporary workaround, consider restricting access to the If: request header to minimize the risk of exploitation. Additionally, restricting access to the mod dav module can also help mitigate the risk of a denial of service attack.
Exploit
Fix
Out of bounds Read
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Http Server
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu