PT-2008-1555 · Apache+1 · Apache Http Server+1

Published 2008-01-02 · Updated 2024-06-15 · CVE-2007-6422

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.0 through 2.2.6

Description A flaw in the mod proxy balancer module allows remote authenticated users to cause a denial of service, resulting in a child process crash, when a threaded Multi-Processing Module is used. This can be achieved by sending a carefully crafted request with an invalid bb variable.

Recommendations For Apache HTTP Server versions 2.2.0 through 2.2.6, consider disabling the balancer handler function in the mod proxy balancer module as a temporary workaround to prevent exploitation. Restrict access to the mod proxy balancer module to minimize the risk of denial of service attacks. Avoid using the bb variable in requests to the affected module until the issue is resolved.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2007-6422

OPENSUSE-SU-2024:10623-1

RHSA-2008:0008

RHSA-2008:0009

RHSA-2008_0008

Affected Products

Apache Http Server

Red Hat

References · 77

• https://security-tracker.debian.org/tracker/CVE-2007-6422 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0048 · Vendor Advisory
• http://secunia.com/advisories/28526 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10623-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00562.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6422 · Security Note
• http://secunia.com/advisories/28749 · Vendor Advisory
• http://ubuntu.com/usn/usn-575-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200803-19.xml · Vendor Advisory
• http://secunia.com/advisories/29640 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6422 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00541.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:016 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0009.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6422 · Vendor Advisory