PT-2009-4352 · Apache+1 · Apache Http Server+1

Published 2009-07-02 · Updated 2024-06-15 · CVE-2009-1890

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.3.3

Description: The issue is related to the stream reqbody cl function in the mod proxy module, which does not properly handle streamed data that exceeds the Content-Length value when a reverse proxy is configured. This allows remote attackers to cause a denial of service by consuming CPU time via crafted requests.

Recommendations: For versions prior to 2.3.3, update to version 2.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mod proxy module when it is used as a reverse proxy until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2009-1890

DSA-1834-1

HPSBUX02612

OPENSUSE-SU-2024:10268-1

RHSA-2009:1148

RHSA-2009:1155

RHSA-2009:1156

RHSA-2009:1160

RHSA-2009_1148

Affected Products

Apache Http Server

Red Hat

References · 126

• http://mandriva.com/security/advisories?name=MDVSA-2009:149 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1956 · Security Note
• http://svn.apache.org/viewvc?view=rev&revision=790587 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1PK91259 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=129190899612998&w=2 · Vendor Advisory
• http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?r1=790587&r2=790586&pathrev=790587 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1452 · Security Note
• http://secunia.com/advisories/37221 · Vendor Advisory
• http://secunia.com/advisories/35691 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3184 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1890 · Vendor Advisory
• http://secunia.com/advisories/37152 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203 · Security Note