PT-2007-3210 · Apache+2 · Apache Http Server+2

Published 2007-06-18 · Updated 2024-06-15 · CVE-2007-1863

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server (httpd) (affected versions not specified)

Description: The issue allows remote attackers to cause a denial of service, resulting in a child processing handler crash. This can be achieved by sending a request with specific Cache-Control headers, including s-maxage, max-age, min-fresh, or max-stale, without a value. The problem occurs when caching is enabled and a threaded Multi-Processing Module (MPM) is used.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2007-1863

HPSBUX02262

OPENSUSE-SU-2024:10623-1

RHSA-2007:0533

RHSA-2007:0534

RHSA-2007:0556

RHSA-2007:0557

RHSA-2007_0534

RHSA-2007_0556

RHSA-2010:0602

Affected Products

Apache Http Server

Hp-Ux

Red Hat

References · 128

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/apache_modjk_overflow.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1355 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3385 · Security Note
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2007-0533.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2450 · Security Note
• http://security.gentoo.org/glsa/glsa-200711-06.xml · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2007-0556.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2007-0534.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1863 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09579 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2007:141 · Vendor Advisory